2600

The Hacker Ouarterly

Volume 5. Number 4 Winter, 1988-89

1884 saw the beginning of public call offices.

The National Telephone Company charged 2d
(or Ip) for a three minute call.
 The Nntionnl Talaphoqa Company, Umttalf.
---
PUllLIC CALL OOIOla.
'u.au' •.
LOC41. CAW (............ a..-p """""

. r ... ..."........... ~........... «I..",Uk:n.... (·~uft. . . . . . . ~. .J.... .,

. . . . _ .... CoII..­

1.''faOO'l'lO.'.

-. . . - _. __.. ­ I_ ... __ .... ..-.

1'0 C.uJ. TIlE EXCIIA,<;It-T........ '-lie. 1_ ..... -.._ ..... _ .... _ ...
.......... .... ...... ...". u.. ~n_ ~ u... ...., 'If"a tIM ftWt. . _
..,. ............ ,-.

............ ...,u.~,.. ..... !Nt II .... I~..., v....: ... ~I,. tM ............. ,. . . . . . . . .

till ........ 01 .... ptNII'f• ..u u.ouac u.. ......... JOUI""'"

~_III
r... ..,.... .... _ wi

1t . . . . . . :l_tuan~1S~"...~:un._,. . . . . . . . . . . . . . _ ....... "' . .

........ ~ .... _ , ........ lt . . . . . . .,CIHt......... ~.'CT ....... ML •

u.... ........-.... _ ....... ,. t.:MMC 4&1 VII" CIIilN..

uw- ... .,_ "'_oJ ... ~ ......,.,......,... _ '" _"'_

--. .... 4_~"".tII ~.~_ ... of IMta 10.. . . . . . ~ 1liI...,............

...-.""_ ... _ _..,11.-..-*"''"',,'''' ...... __ ..,... - ' 1 _ ...

_ . . it ..............

............ _ _ _ _ _ .. ..u,.. L............. ____

11'_.......,.,................ __•._­
~

..................
. . . . ___

. . . . _wIIIob _ _

..... CIooto....-..
~~_wiIl--...auo.-_
u.. .... _"'r..... .........
_
. __..

........
• poDIM _ _
.l tIoo a..........oa rqOJ .. " " 1 - o,.r- ... --.. Ie _ _

_ _ \O UO' . . . . . . . . .
Ia.......,

..

~
\
I
I
4
I
i
I
'
-sw. MOl IW ""', bJ' <ilia _ ......, -IlIaC ot uo. .~ ... " ' - .
 We Know

You should have had this issue last
month. We know. We're sorry.
Hut just because we avoided the
holiday rush (by not contributing to
it) doesn't mean that you'll be losing
out. Infact, we used the extra time
to further pursue the late breaking
MCI scandal (see page 10) as well
as a couple of other stories, includ­
ing the latest on the famous virus.
We've been playing with our new
adjunctframe (mentioned last time
in this column) and are rather
pleased with the results. We have all
ofthe advantages ofequal access
and direct overseas dialing without
having an electronic or digital
switch. The extra time involved to
complete a call is negligible. And
touch tones are still free!
The MCI story is the first result of
our new toy. As we scan out differ­
ent companies and investigate them,
more tales will unfold.

STAFFBOX
Editor-In-Chief

Emmanuel Goldstein

Office Manager Artwork

Bobby Arwatt Tish Valter Koch

Writers: Eric Corley, Thomas Covenant, John Drake, Mr. French,

The Glitch, Chester Holmes, Lex Luthor, Phantom Phreaker,
Bill from RNOC, David Ruderman, Lou Scannon, Silent Switchman,
Mike Yuhas, and the usual anonymous bunch.
2600 (ISSN 0749-3851) is published quarterly by 2600 Enlerprises Inc.. 7 Strong's Lane. Setauket.
NY 11733. Second class postage permit p,tnding at Setauket. New York

POSTMASTER: Send address changes to 2600, P,O. Box 752, Middle Island, NY 11953-0752.

Copyright (c) 1988. 2600 Enterprises, Inc.

Yearly subscription: U,S. and Canada" $15 individual, $40 corporate.

Overseas -- $25 individual, $55 corporate.

Back issues available for 1984. 1985. 1986, 1987 at $25 per year, $30 per year overseas.

ADDRESS ALL SUBSCRIPTION CORRESPONDENCE TO: 26M Subscription Dept., P.O.

Box 752, Middle Island, NY 11953-0752.

FOR LETTERS AND ARTICLE SUBMISSIONS, WRITE TO: 2600 Editorial Dept., P.O. Box

99. Middle Island, NY 11953-0099.

2(J)0 Office Line: 516-751-2600
BBS 1# I (OSUNY): 914-725 -4060 (down atthe moment)
BBS 112 (CENTRAL OFFICE): 914-234-3260
BBS 113 (YOYODYNE): 402-564-4518
BBS 114 (BEEHIVE): 703-823-6591
BBS #5 (HACKER'S DEN): 718-358-9209
USENET ADDRESS: 260<Xi!ldasysI.UUCP
ARPAKET ADDRESS: phri!dasys1 !26OO@nyu

Winter 1988-89 2600 Magazine Page 3

 A Report on the

by Bob Page
worm opens a TCP connection to
University of Lowell
another machine's sendmail (the
Computer Science Depanment
SMTP port), invokes debug mode,
(Reprinted from the RISKS and sends a RCPT TO that
Newsletter, an electronic publica­ requests its data be piped through
tion available on many machines a shell. That data, a shell script
that are accessible by networks.) (first-stage bootstrap) creates a
temporary second-stage bootstrap
Here's the scoop on the file called x$$,11.c (where "$$" is
"Inte'rnet Worm". Actually it's not a the current process ID). This is a
virus a virus is a piece of code small (40-line) C program.
that adds itself to other programs, The first-stage bootstrap com­
including operating systems. It piles this program with the local cc
cannot run independently, but and executes it with arguments
rather requires that its "host" pro­ giving the Internet hostid/
gram be run to activate it. As such, socket/password of where it just
it has a clear analogy to biological came from. The second-stage
viruses -- those viruses are not bootstrap (the compiled C pro­
considered live, but they invade gram) sucks over two object files,
host cells and take them over, x$$,vax.o and x$$,sun3.0 from the
making them produce new viruses. attacking host. It has an array for
A worm is a program that can 20 file names (presumably for 20
run by itself and can propagate a different machines), but only two
fully working version of itself to (vax and sun) were compiled in to
other machines. As such, what this code. It then figures out
was set loose on the Internet was whether it's running under BSD or
clearly a worm. SunOS and links the appropriate
This data was collected through file against the C library to produce
an emergency mailing list set up an executable program called
by Gene Spafford at Purdue lusr/tmp/sh -- so it looks like the
University, for administrators of Bourne shell to anyone who
major Internet sites some of the looked there.
text is included verbatim from that The Fingerd Attack
list. In the fingerd attack, it tries to
The basic object of the worm is infiltrate systems via a bug in fin­
to get a shell on another machine gerd, the finger daemon.
so it can reproduce further. There Apparently this is where most of its
are three ways it attacks: send­ success was (not in sendmail, as
mail, fingerd, and rsh/rexec. was originally reported). When fin­
The Sendmail Attack gerd is connected to, it reads its
In the send mail attack, the arguments from a pipe, but doesn't

Page 4 2600 Magazine Winter 1988-89

Internet Worm

limit how much it reads. If it reads special "popular" passwords:

more than the internal 512-byte aaa, academia, aerobics, air­
buffer allowed, it writes past the plane, albany, albatross, albert,
end of its stack. After the stack is a alex, alexander, algebra, aliases,
command to be executed alphabet, ama. amorphous, ana­
("/usr/ucb/finger") that actually log, anchor, andromache, ani­
does the work. On a VAX, the mals, answer, anthropogenic,
worm knew how much further from anvils, anything, aria, ariadne,
the stack it had to clobber to get to arrow, arthur, athena, atmo­
this comr;nand, ____________ sphere, aztecs,
which it replaced " . . azure.

with the command It lS pretty successful in bacchus, bailey,

"/bin/sh" (the finding passwords, as most banana, bananas,

bourne shell). So people don't choose them bandit, banks, bar­

inslead of the fin- very well." ber, baritone, bass,

ger command
being executed, a------------beater,
shell was started with no argu­ beethoven. beloved, benz,
bassoon, batman,

beauty,

menls. Since this is run in the con­ beowulf, berkeley, berliner, beryl,
text of the finger daemon, stdin beverly, bicameral, bob, brenda,
and stdout are connected to the brian, bridget, broadway, bum­
network socket, and all the files bling, burgess.
were sucked over just like the shell campanile, cantor, cardinal,
that sendmail provided. carmen, carolina, caroline, cas­
The RSH/REXEC Attack cades, castle, cat, cayuga, cellics,
The third way it tried to get into cerulean, change, charles, charm­
systems was via the .rhosts and ing, charon, chester, cigar, clas­
letclhosts.equiv files to determine sic, clusters, coffee, coke, collins,
"'rusted" hosts where it might be comrades, computer, condo,
able to migrate to. To use the cookie, cooper, cornelius, cous­
.rhosls feature, it needed to actual- cous, creation, creosote, cretin.
Iy get into people's accounts -­ daemon, dancer, daniel,
siQce the worm was not running as danny, dave, december, defoe,
root (it was running as daemon) it deluge, desperate, develop,
had to figure out people's pass­ dieter, digital, discovery, disney,
words. To do this, it went through dog, drought, duncan.
the letc/passwd file, trying to eager, eaSier, edges, edin­
guess passwords. It tried combina­ burgh, edwin, edwina, egghead,
lions of- the username, the last, eiderdown, eileen, einstein, ele­
first, last and first, nicknames (from phant, elizabeth, ellen, emerald,
the GECOS field), and a list of engine, engineer, enterprise,

Wimer 1988-89 2600 Magazine Page 5

 The Virus

enzyme, ersatz, establish, estate, outlaw. oxford.

euclid, evelyn, extension. pacific, painless, pakistan,
fairway, felicia, fender, fermat, pam, papers, password. patriCia,
fidelity, finite, fishers, flakes, float, penguin, peoria, percolate, per­
flower, flowers, foolproof, football, Simmon, persona, pete, peter,
foresight, format, forsythe, fourier, philip, phoenix, pierre, pizza,
fred, friend, frighten, fun, fungible. plover, plymouth, polynomial,
gabriel, gardner, garfield, pondering, pork, poster, praise,
gauss, george, gertrude, ginger, precious, prelude, prince, prince­
glaci,er, gnu, golfer, gorgeous, ton, protect, protozoa, pumpkin,
gorges, gosling, gouge, graham, puneet, puppet.
gryphon, guest, guitar, gumption, rabbit, rachmaninoff, rainbow,
guntis, raindrop, raleigh, random, rascal,
hacker, hamlet, handily, hap­ really, rebecca, remote, rick, rip­
pening, harmony, harold, harvey, ple, robotics, rochester, rolex,
hebrides, heinlein, hello, help, romano, ronald, rosebud, rose­
herbert, hiawatha, hibernia, mary, roses, ruben, rules, ruth.
honey, horse, horus, hutchins. sal, saxon, scamper, scheme,
imbroglio, imperial, include, scott, scotty, secret, sensor,
ingres, inna, innocuous, irishman, serenity, sharks, sharon,
isis. sheffield, sheldon, shiva, shivers,
japan, jessica, jester, jixian, shuttle, Signature, Simon, simple,
johnny, joseph, joshua, judith, jug­ singer, single, smile, smiles,
gle, julia. smOOCh, smother, snatch,
kathleen, kermit, kernel, kirk­ snoopy, soap, socrates, sossina,
land, knight. sparrows, spit, spring, springer,
ladle, lambda, lamination, squires, strangle, stratford,
larkin, larry, lazarus, lebesgue, stuttgal1, subway, success, sum­
lee, leland, leroy, lewis, light, lisa, mer, super, superstage, support,
louis, lynne. supported, surfer, suzanne,
macintosh, mack, maggot, swearer, symmetry.
magic, malcolm, mark, markus, tangerine, tape, target, tar­
marty, marvin, master, maurice, ragon, taylor, telephone, tempta­
mel/on, merlin, mets, michael, tion, thailand, tiger, toggle,
michelle, mike, minimum, minsky, tomato, topography, tortOise, toy­
moguls, moose, morley, mozart. ota, trails, trivial, trombone, tubas,
nancy, napoleon, nepenthe, tuttle.
ness, network, newton. next, nox­ umesh, unhappy, unicorn,
ious, nutrition, nyquist. unknown, urchin, utility.
oceanography. ocelot, olivetti. vasant, vertigo, vicky, village,
olivia, oracle. orca, orwell, osiris. virginia.

Page 6 2600 Magazine Winter 1988·89

We Were All Waiting For
warren, water, weenie, what­
not, whiting, whitney, will, william,
williamsburg, willie, winston, wis­
consin, wizard, wombat. wood­
wind, wormwood.
yaco, yang, yellowstone,
yosemite.
zap, zimmerman.
[I wouldn't have picked some of
these as "popular" passwords, but
then again, I'm not a worm writer.
What do I kn0w?]
When everything else fails, it
opens lusr/dict/words and tries
every word in the dictionary. It is
pretty successful in finding pass·
words, as most people don't
choose them very well. Once it
gets into someone's account, it
looks for a .rhosts file and does an
"rsh" and/or "rexec" to another
host, sucks over the necessary
files into lusr/tmp and runs
lusr/tmp/sh to start all over again.
Between these three methods
of attack (sendmail, fingerd,
.rhosts), it was able to spread very
quickly.
The Worm Itself
The "sh" program is the actual
worm. When it starts up it clobbers
its argv array so a "ps" will not
show its name. It opens all its nec­
essary files, then unlinks (deletes)
them so they can't be found (since
it has them open, however, it can
still access the contents). It then
tries to infect as many other hosts
as possible .- when it successfully
connects to one host, it forks a
child to continue the infection while
Winter /988-89
the parent keeps on trying new
hosts.
One of the things it does before
it attacks a host is connect to the
telnet port and immediately close
it. Thus, "telnetd: ttloop: peer died"
in lusr/admlmessages means the
worm attempted an attack.
The worm's role in life is to
reproduce .- nothing more. To do
that it needs to find other hosts. It
does a "netslat -r -n" to find local
routes to other hosts & networks,
looks in letc/hosts, and uses the
yellow pages distributed hosts file
if it's available. Any time it finds a
host, it tries to infect it through one
of the three above methods. Once
it finds a iocal network (like
129.63.nn.nn for ulowell) it
sequentially tries every address in
that range.
If the system crashes or is
rebooted, most system boot proce­
dures clear Itmp and lusrltmp as a
matter of course, erasing any evi­
dence. However, sendmaillog files
show mail coming in from user
Idev/null for user Ibin/sed, which is
a tipoff that the worm entered.
Each time the worm is started,
there is a 1/15 chance (it calls ran­
domO) that it sends a single byte
to ernie.berkeley.edu on some
magic port, apparently to act as
some kind of monitoring mecha­
nism.
The Crackdown
Three main 'swat' teams from
Berkeley, MIT, and Purdue found
copies of the VAX code (the .0
2600 Magazine Page 7

files had all the symbols intact with
somewhat meaningful names) and
disassembled it into about 3000
lines of C. The BSD development
team poked fun at the code, even
going so far to point out bUgs in
the code and supplying source
patches for it! They have not
released the actual source code,
howev.er, and refuse to do so. That
could change -- there are a num­
ber of people who want to see the
code.
Portions of the code appear
incomplete, as if the program
development was not yet finished.
For example, it knows the offset
needed to break the BSD fingerd,
but doesn't know the correct offset
for Sun's fingerd (which causes it
to dump core); it also doesn't
erase its tracks as cleverly as it
might; and so on.
The worm uses a variable
called "pleasequit" but doesn't cor­
rectly initialize it, so some folks
added a module called _worm.o to
the C library, which is produced
from: int pleasequit :::; -1; the fact
that this value is set to -1 will
cause it to exit after one iteration.
The close scrutiny of the code
also turned up comments on the
programmer's style. Verbatim from
someone at MIT: "From disassem­
bling the code, it looks like the pro­
grammer is really anally retentive
about checking return codes, and,
in addition, prefers to use array
indexing instead of pointers to
walk through arrays."
Page 8 2600 Magazine Winter 1988-89
Chaos in the
Anyone who looks at the binary
will not see any embedded strings
- they are XOR'ed with 81 (hex).
That's how the shell commands
are imbedded. The "obvious"
passwords are stored with their
high bit set.
Although it spreads very fast, it
is somewhat slowed down by the
fact that it drives the load average
up on the machine -- this is due to
all the encryptions going on, and
the large number of incoming
worms from other machines.
[Initially, the fastest defense
against the worm is to create a
directory called lusr/tmp/sh. The
script that creates lusrltmp/sh from
one of the .0 files checks to see if
lusr/tmplsh exists. but not to see if
it's a directory. This fix is known as
"the condom".]
Now What?
None of the ULoweli machines
were hit by the worm. When BBN
staffers found their systems infect­
ed, they cut themselves off from all
other hosts. Since our connection
to the Internet is through BBN, we
were cut off as well. Before we
were cut off, I received mail about
the sendmail problem and installed
a patch to disable the feature the
worm uses to get in through send­
mail. I had made local modifica­
tions to fingerd which changed the
offsets, so any attempt to scribble
over the stack would probably
have ended up in a core dump.
Most Internet systems running
4.3BSD or SunOS have installed
computer Networks

possible that the bytes sent to

the necessary patches to close the ernie.berkeley.edu were intended
holes and have rejoined the to monitor the spread of the worm.
Internet. As you would expect, Some news reports mentioned
there is a renewed interest in sys­ that he panicked when, via some
tem/network security, finding and "monitoring mechanism" he saw
plugging holes. and speculation how fast it had propagated.
over what will happen to the A source inside DEC reports
worm's creator. that although the worm didn't
If you haven't read or watched make much progress there, it was
the news, various log files have sighted on several machines that
named the responsible person as wouldn't be on its normal propaga­
Robert Morris Jr., a 23-year old tion path, Le. not gateways and
doctoral student at Cornell. His not on the same subnet. These
father is head of the National machines are not reachable from
Computer Security Center, the the outside. Morris was a summer
NSA's public effort in computer intern at DEC in '87. He might
security, and has lectured widely have included names or address­
on security aspects of UNIX. es he remembered as targets for
AssOCiates of the student claim infesting hidden internal networks. .
the worm was a "mistake" -- that Most of the DEC machines in
he intended to unleash it but it was question belong to the group he
not supposed to move so quickly worked in.
or spread so much. His goal (from The final word has not been
what I understand) was to have a written -- I don't think the FBI has
program "live" within the Internet. If even met with this guy yet. It will
the reports that he intended it to be interesting to see what hap­
. spread slowly are true, then it's pens.

DO YOU HAV£ A fULL SET

OF 2600 BACK ISSUES?

They're available at a rate of $25 per year ordered. Back issues

start with t 984 and indude every issue up to the present.

(1988 issues are still available at $5 each. All others are sold

ONLY by year.) Send your order to:

2600 Back Issues

POBox 752

Middle Island. NY t 1953

Winter 1988-89 2600 Magazine Page 9

 MCI: The Phone Company With
It all started with what sounded like a
friendly phone call in October:
"Hello, this is Patricia from MCL We
noticed that you presently have an account
with MCI and we wanted to let you !mow
that we'll be offering 'one plus' service in
your area starting December 10th. We'd
like to verify your address."
The nice lady then read us our address,
which was one hundred percent correct.
She then said another person would call us
to confirm this information. That call
came within minutes and was almost iden­
tical in content.
A couple of weeks later we got another
one of those calls on another of our lines
that had an MCI account attached to it.
But this time the second call never came.
In early December, equal access came
to our phone lines. We decided to check
the status of those two lines that had got­
ten the calls, We dialed 1-700-555-4141.
And guess what? They had both been
claimed by MCL Surprised? We weren't.
In fact, when those cal1s come in, we
expected them to try and pull this scam
we'd heard so much about. They made one
big mistake though -- they tried it on us.
We always listen very carefully when
phone companies call us, And we can say
very definitely that MCI never asked us if
we wanted to choose them as our long dis­
tance carrier. All they asked us to do was
to verify our address.
OK, so it was a sloppy representative.
Maybe even a corrupt one. How can you
condemn an entire company because of
the actions of one person? That's quite
easy, It happened more than once.
Different representatives called diffe;enl
phone numbers and gave the same little
speech, And we've found out that other
people have gotten the same treatment.
This indicates to us that these representa­
tives are reading a script that tells them
no/ to a')k the customer whether they actu­
ally wan.1 Mel's "one plus" service.
Address verification. aftel al1. is a much
less controversial issue,
Page 10 2600 Magazine Winter 1988-89
Perhaps MCI feels they're taking a cal­
culated risk here. They only seem to make
these calls to people who already USE!' MCI
in some form. Maybe they feel these peo­
ple won't raise a fuss when they discover
who their long distance company is. In
fact, they may never even discover that
MCI is their carrier since they most likely
have been getting MCI bills in the past.
Remember, these are people who have
already been using MCl's services.
Regardless of whether or not it pays
off. it's distressirig to see such dishonest
tactics on the part of a major company.
This isn't our only gripe with MCI. We
had been using an account on MCfs 950­
1986 dialup. In November we paid the bill
a few days late (it was under $10). Well,
10 and behold. they disconnected our code
without any warning. When we asked
them to reconnect it, they said they would
have to handle our payment for 10 days
first. Ten days went by and the code was
still down. We asked again. This time.
they said they were phasing out that ser­
vice, so they couldn't reconnect us. But
they came up with a bright idea. We could
use our 14-digit MCI Card code instead of
our old 5-digit code. "It's just as easy to
remember," they said.
Clearly, they have the right to phase
out their services and replace them with
less desirable ones. But once again. it's the
way in which they did it. MCI jumped at
the first opportuniry to take away our old
code instead of being up front and letting
their customers know that as of a certain
date this service would be terminated.
Being sneaky about it doesn't do anyone
any good.
The Real Scam
We've saved the best for last. When we
discovered that MCI had selected them­
selves as our long distance carriers, we
decided to experiment a little. One of our
experiments involved trying to make an
operator assisted call ("zero plus") on an
MCI line. MCI doesn't offer operator
assisted services. So we were curious as to
A Lot of Explaining To Do
what would happen when we tried to do
this.
What happened was a big surprise. We
gOl the same little fading dial tone that we
got on AT&T ~~ in other words, the
prompt to enter our AT&T calling card
number. We entered the card number and
were astounded to hear a recording say,
"Thank you for using NTS."
NTS? Who the hell were they?' And
what were they doing accepting AT&T
calling card numbers on Mel lines'!
We'll skip all of the drama and simply
tell you what we found out. NTS is an
Allcmate Operator Service (AOS) compa­
ny. They handle calls from hotel rooms
and privately owned payphones. Their
rates are often double those of AT&T.
And it seems that in various parts of the
country, MCI has a clandestine relation­
ship with these people. We say clandestine
because we're in the habit of reading all of
the literature from every phone company
that serves our area. And nowhere has this
lillie "service" been mentioned. We have
yet to find anyone in MCI who is even
aware of this arrangement. On the other
hand, NTS (based in Rockville, Maryland)
is quite proud of the Mel connection. All
of the NTS operators (who can trick any­
one into believing they're really from
AT&T) are aware that they provide ser­
vice for MCI "zero plus" customers.
Why does Mel use an AOS? We can't
imagine. But we can tell you the effects. If
you decide to call someone collect from
YOUT phone and Mel happens to be your
long distance carrier, the person who
accepts on the other end will wind up with
one hell of a surprise when they get the
bIll. You'1I be the one getting the surprise
if you forget that MCI doesn't have opera­
tors ,md you attempt to place an operator­
assisted or calling card call through them.
The most likely scenario, though. would
be something like this: you visit a friend
and need to make a phone call from his
hOllse. Since you don't want to make your
friend pay, you dial it "zero plus" and bill
it \0 your calling c!lld. How are you to
Winter 1988-89
know that your friend selected MCI as his
long distance carrier and that you've just
been swindled by an AOS? Perhaps MCl's
new slogan can be: "We bring the thrill of
hotel phones right into your own home!"
Now we should point out that this
"NTS Connection" doesn't work every­
where. In some areas you get recordings
when you try to make "zero plus" calls
using Mel. We need to know where it
does work. You can find out at no charge
by dialing 10222~0 followed by a ten digit
phone number (you can use your own). If
you hear a fading dial tone, it means
you're about to be connected to NTS. You
can stay on and ask a whole lot of ques­
tions if you want. Let us know if it works
in your area. (You can do the above even
if MCI isn't your primary carrier the
10222 routes the call to MCI. You must
have equal access in your area in order to
try this.)
There's really not much more to add.
We are demanding a public statement
from Mel addressing the issues of signing
up unsuspecting consumers and billing
their own customers exorbitant rates for
operator-assisted calls without telling
them. We don't expect to ever get such a
statement.
Several yeats ago, we printed a story
about MCl's electronic mail system. Mel
Mail, which had a policy of terminating
accounts that had received mail not to
MCl's liking. We called it a flagrant inva­
sion of privacy to peruse the mail of their
own paying subscribers. The president of
Mel indicated that he couldn't care less.
So all we can say right now is that it
would be a very good idea to boycott
Mel for all of the above reasons. A com­
pany that resorts to such devious methods
of making money and that treats its cus­
tomers so shabbily is not worthy of the
historical significance its founders
achieved.
We would appreciate it if this article
was spread around in whatever ways pos­
sible.
2600 Magazine Page 11
 A HACKER'S GUIDE

by Red Knight get in.

Phreakers/Hackers Underground No more log ins . will happen when
Network the system won't accept any more
Brief History of UNIX log ins. This could mean the system is
It's because of Ken Tompson that going down,
today we're able to hack UNIX. He Unknown 10 - will happen if an invalid
used to work for Bell Labs in the 60's. 10 is entered using the (su) command.
Tompson started out using the Your password has expired - This is
MULTICS as. It was later eliminated quite rare. Reading the etclpasswd will
and Tompson was left without an show you at what intervals it changes.
operating system to work with. He had You may not change the password­
to come up with something really The password has not yet aged
quick. He did some research and in enough. The administrator sets the
1969 UNIX came into being. It was a quotas for the users.
single user system and it didn't have Unknown group [group's name] ­
many capabilities. In a combined effort occurs when chgrp is executed and
with others he rewrote the version in C the group doesn't exist.
and added some good features. This Sorry· indicates that you have typed
version came out in 1973 and was in an invalid super user password
made available to the public. This was (execution of the su).
the beginning of UNIX as it's presently Permission denied! - indicates you
k.nown. The more refined version of must be the owner or a super user to
UNIX is known as UNIX system V. It change the password.
Nas developed by Berkeley University Sorry [t of weeks] since last
and it has unique capabilities. change· this will happen when the
Various types of UNIXes are CPIX, password has not aged enough and
Berkeley Ver 4.1. Berkeley 4.2, FOS, you try to change it.
Genix, HP-UX, ISII, OSx, PC· IX, [directory name]: no permission ­
PERPOS, Sys3, Ultrix, Xenix, you are trying to remove a directory for
UNITY, VENIX, UTS, Unisys, which you have no permission.
Uniplus+. UNOS, IdflS, QNIX, [file name] not removed - trying to
Coherent, CromlX, System III. System delete a file owned by another user
7. sixth edition. that you don't have write permission
Hacking UNIX for,
I beheve that hacking into any com· [dirname] not removed· ownership
puter requires knowledge of the oper­ of the dir that you're trying to delete is
ating system itself. Basically what I will not yours.

try to do is get you to be more familiar [dlrname] not empty - the directory

with UNIX operation and its useful contains files so you must delete the

commands, files before executing the rmdir.

Error Messages (UNIX system V) [command] not found - you have

Login incorrect - an invalid 10 and/or entered an invalid command which is

password was entered. This means not known to UNIX.

very little. In UNIX there is no way of can't execute pwd - something's

gueSSing valid user 10's. You may wrong with the system and it can't exe·

come across this one when trying to cute the pwd command.

"age 12 2600 Magazine Winter /988-89

TO UNIX

cannot chdlr to " - (.. means one

edcasey, and also some containing
level up) permission is required to exe­ numbers: smith1, mitu6, and some
cute pwd above the current directory.
containing special characters like bre­
can't open [file name] you defined
mer$, j#fox. Login names have to be 3
the wrong path or file name or you
to 8 characters in length, lowercase,
have no read permission.
and must start with a letter. In some
cp: [file name] and [file name) are
XENIX systems one may login as
identical - self-explanatory.
"guest".
cannot locate parent directory,
User Level Accounts
occurs when using mv.
In UNIX they have what are called
[file name] not found file which
accounts. These accounts can be
you're trying to move doesn't exist.
used at the ~Iogin:~ prompt. Here is a
You have mall - self-explanatory.
list:
Error Messages sys
(Basic Networking Utility) bin
cu: not found networking not trouble
installed. daemon
login failed - invalid 10 or password or uucp
wrong number specified. nuucp
dial failed - the system never rje
answered due to a wrong number. Ip
uucp completely failed did not adm
specify file after -so listen - if starlan is installed
wrong time to call - you called at a
time not specified in the systems file.
system not in systems, you called a "Super user accounts

remote not in the systems file.

UNIX Logon Format make UNIX worth

The first thing you must do is switch

to lower case. hacking. "

Here is what you will see (some­

times there will be no system identifi­
er).

AT&T UNIX Sys VR3.0 (example of a Super User Accounts

system identifier)
login:
or
Login:
Any of these is a UNIX. This is
where you will have to guess at a valid
user 10. Here are some that I have
come across: glr, glt, radgo, rml.
chester, cat, 10m. cora. hlto, hwill,
And then there are super user
accounts which make UNIX worth
hacking. These accounts are used for
a specific job. In large systems they
are assigned to users who have a
responsibility to maintain subsystems.
They are as follows (all lower case):
root - this is a must. The system
comes configured with it. It has no
restrictions. It has power over every

Winter 1988-89 2600 Magazine Page 13

 HACKING AWAY

other account.
The letters can be in upper case or
unmountsys . unmounts files.
lower case. Here are some of the
setup. system setup.
passwords that 1 have seen: Ansuya1,
makefsys . makes a new file.
PlATOON6, uFo/7B, ShAsHi .. ,
sysadm . allows useful commands
Div417co.
(doesn't need root login).
The passwords for the super user
powerdown . powering system down.
accounts will be difficult to hack. You
mountfsys . mounts files.
can try th'e accounts interchangeably
checkfsys . checks files.
(example: login:sysadm password:
Thes.e accounts will definitely have makefsys). It really could be anything.
passwords assigned to them. These The user passwords are changed by
accounts are also commands used by an aging process at successive inter·
the system administrator. Here are vals. The users are forced to change
some examples of accounts I have it. The super user will pick a password
seen' that won't need changing for a long
cron
period of time.
uuhelp
You Have Made It!
usenet
The hard part is over and hopefully
anonuccp
you have hacked a super-user
news
account. The next thing you'll probably
network
see is the system news:
bellboy

Ip
login:john
vector
password:hacker1
guest
System news
games
There wilt be no networking offered
ninja
to the users till August 15, due to
vote
hardware problems.
warble

sysinfo
$

Password Entry $ is the UNIX prompt which means

After the login prompt you will that UNIX is waiting for a command to
receive a password prompt: be entered. I will use this throughout
the article to show outputs, etc. (it's
password:
not a part of the command). # means
or
you're logged in as root (very good).
Password:
How UNIX is Made Up
UNIX is made up of three compo­
Enter the password (it won't echo). nents: the shell, the kernal, and the file
The password rule is as follows: each system.
password has to contain at least six The Shell
characters. The maximum is eight. The sheH is a high level language.
Two of these have to be letters and at It has two important uses. It acts as a
least one has to be a number or a spe· command interpreter. For instance,
cial character. when using commands like cat, who,

Page 14 2600 Magazine Winter 1988-89

ON UNIX

Is, etc., the shell is at work figuring out ular user (this directory contains the
whether you have entered a command Ipasswd file).
correctly or not. The second most Here are some files under the letc
important reason for the shell is its directory:
ability to be used as programming lan­ letclpasswd
guage. Suppose you're performing letclutmp

some tasks repeatedly over and over letcladm/sulog

again. You can program the shell to do letclmotd

this for you. letclgroup

The Kernal letclconf

You could say that the kernal is the letclprofile

heart of the UNIX operating system.
The kernal is a low level language Idev - contains files for physical
lower than the shell which maintains devices such as the printer and the
processes. The kernal handles memo­ disk drives.
ry usage. maintains the file system,
the software, and hardware devices. Itmp - temporary file directory.
The File System
The file system in UNIX is divided /lib - directory that contains programs
into three categories: directories. ordi­ for high level languages.
nary files. and special files. (d,-)
SEE FIGURE A. lusr - this directory contains directo­
ries for each user on the system.
lunix - is the kernal Example of a list of files under lusr:
lusrltmp
letc - contains system administrator's lusrllib
files. Most are not available to the reg­ lusr/docs

Basic s!ructure

(I) • this IS an abbreviation for the root directory.

root level root
(/) system
....................................+.................................level

I I I I I I I I
IUniX liHC Idev Itmp Ilib lusr lusr2 Ibin
I __L .._
10gll1 passwd I I I
level /john Icathy

-1-'
,profile {mail
I
lpers Igames fbin
I
I I
fmichelle
_l_ _
·.profile in case I _L­ I
you wish to change capital I I data I I
, your environment. othello stalWars letter lelter1
Afler you log off, il
resets to the default.

FIGURE ill.

Winter 1988-89 2600 Magazine Page 15

 HACKER'S GUIDE

lusrlnews lusr/john • assuming that you have

lusrlspool
hacked into John's account.
lusr Ispooi/ip
$
fusr/lib/uucp

Now let's say you wanted to move

!bin - contains executable programs down to the michelle directory (you
(commands) own this) which contains letters. You
would type in:
The root also contains: $cd michelle
Ibck - used to mount a backup file or
system. $ cd usr/john/michelle
linstall - used to install and remove $pwd
utilities. lusr/john/mlchelle
Ilost+found this is where all the $
removed files go. This dir is used by To go back one directory. type in:
fsck (1M), $cd •.
Isave - a utility used to save data. or to go back to your parent directo­
Imnt - used for temporary mounting. ry, just type in ·cd".
To list file directories. assuming you
local Commands are in the parent directory:
Explained in Detail $Is lusr/john
At the UNIX prompt, type the pwd mall
command. It will show you the current pers
working directory you are in. games
bin
$pwd michelle
lusr/admin - assuming that you have This won't give you the .profile file.
hacked into a super user account. To view it type:
$ $cd
$Is -a
This gives you the full login directo­
ry. The I before tells you the location
of the root directory, .profile
or
To list file names in michelle's
(refer to the diagram above)
directory type in:
$pwd
$ Is michelle (that is, if you're in the

$15 -I
total 60
·rwxr-x.. - 5 John bluebox 10 april 9 7:04 mail
drwx...... 7 joM bluebox 30 april 2 4:09 pers

-rwxr-.-" 6 cathy bluebox 13 april 1 13:00 pariys

$
FIGURE B

Page /6 2600 Magazine Winter 1988-89

TO UNIX
"john" directory)
$ Is lusrJjohn/michelle (parent direc­
tory)
Is -I
The Is -I is an an important com­
mand in UNIX. This command dis­
plays the whole directory in long
format. Run this in the parent directo­
ry.
SEE FIGURE B.
The total 60 tells you the amount of
disk space used in a directory. The
rWXr-X--- is read in triples of three. The
first character (-,d,b,c) means the fol­
lowing: - is an ordinary file, d is a
directory. b is a block file, c is a char­
acter file.
The r stands for read permission, w
for write permission, x for execute.
The first column is read in three triples
as stated above. The first group of
three (in -rwxr-x---) after the "-"
specifies the permission for the owner
of the file, the second triple is for the
groups (the fourth column), and the
last triple indicates the permissions for
all other users. Therefore the -rwxr-x--­
is read as follows: the owner john has
permission to read, write, and execute
anything in the bin directory but the
group has no write permission to it and
the rest of the users have no permis­
sion at a·11. The format of one of the
lines in the above output is as follows:
file type/permissions, links, user's
name, group, bytes taken, date, time
when last renewed, directory or fiie
name.
chmod
The chmod command changes per­
mission of a directory or a file. Format
is chmod who(+, -, =)(r, w, x). The who
is substituted by u-user, g-group, 0­
other users, a-all. The + means add
Winter 1988-89
permission, means remove permis­
sion, = means assign. Example: if you
wanted all other users to read the file
named mail, you would type:
$ chmod o+r mall
cat
Now suppose you wanted to read
the file letter. There are two ways of
doing this_ First, go to the michelle
directory. Then type in:
$ cat letter
line one •••\
line two •..the output of letter
line three ••J
$
or if you are in the parent directory,
type in:
$ cat lusrJjohn/mlchelie/letter
and you will have the same output
Some cat options are: Os, -u, -v, -e, -t.
Special Characters In UNIX
* - matches any number of single char­
acters. (Example: Is john' will list all
files that begin with john.)
[.••J . matches anyone of the charac­
ters in the [ ].
? - matches any single character.
& - runs a process in the background
leaving your terminal free.
$ - values used for variables also $n •
null argument.
> - redirects output.
< - redirects input to come from a file.
» - redirects command to be added
to the end of a file.
I - pipe output (Example: wholwc-I tells
us how many users are online).
passwd
Password changing seems to be a
big thing among some. To change the
password, one would use the "pass­
(continued on page 40)
2600 Magazine Page 17
 GALL DEPT.

CI
Cl

'"
o
-

a.

'"'"
...I
...<'t
o

.­
....
III

......
III

;..:~
CI""
.o~

E .
'" '"
z~

'§t.­
8g~
u u '"
<00.

~
o
~
Z
CIt
U
C
III
iii
'iii
:l...
- o
f
CIt
Q.
o

IT TOOK i\ LOT OF GALL for someone to call us collect and somehow convince
an untrained operator that we had accepted the charges and then apparently talk to
our answering machine for seven minutes. It also takes a lot of gall for an Alternate
Operator Service company like the above to charge the astronomical rates they do,
let alone come up with an official sounding name like "Operator Assistance
Network". When we first saw that line on the phone bill, we thought it was some
kind of tax or surcharge. That's why we decided to expend a little gall of our own
and expose the entire sordid affair, phone numbers and all.

Page 18 260() Magazine Winter 1988-89

how to hear phone ca 11 s
You too can be nosy and lis­
ten in to other people's tele­
phone calls with a radio
receiver. Depending on what
kind of radio(s) you have. here
are the things you can pull in:
Short Wave Radio: You need a
general coverage receiver that
is capable of receiving in single
sideband mode (SSB) or has a
BFO mode. Your antenna can
either be the whip antenna on
the radio or a long piece of
wire, ten to fifty feet. running
around your home or better
yet. outside to a tree or pole.
You will be able to tune ship to
shore telephone calls within
the following frequency bands
(all numbers in kilohertz):
4357-4434.
6506-6521.
8718-8812.
13100-13197,
17232-17356.
22596-22716.
These frequencies are the
shore station. which usually
broadcasts both sides of the
conversation. TransmIssions
are in upper sideband (USB)
mode. Conversations may roll
in from all over the world.
especially at night. and will be
in many different languages.
Some shortwave receivers
can tune all the way down to
the AM band. If yours does,
check 1690 to 1770 kilohertz,
where the old cordless tele­
Winter 1988-89
phone base channels are locat­
ed.
Standard UHF/VHF Scanner:
You can pick up cordless
phones in your immediate
viCinity. IMTS (old style car
phones) in your general area.
and airplane phones flying
overhead. For the base sta­
tions. you'll usually hear both
sides of the conversation,
although sometimes the mobUe
caller won't be audible and
you'll just have to imagine
what they're saying. Use either
the whip antenna on your
scanner or buy an outdoor
scanner antenna. These fre­
quencies are listed in mega­
hertz:
Cordless phones
46.610 to 46.970
IMTS car phones
152.510 to 152.810
(base stations)
Airplane phones
454.025 to 455.000
(land stations)
459.025 to 460.000
(airplanes)
The ECPA bans listening to
car telephones. Cordless and
airplane phones are governed
by section 605 of the
Communications Act of 1934,
which says you can listen all
you want as long as you do not
divulge the information to any­
one else or use it for profit.
800 Mhz Scanner: Newer
2600 Magazine Page 19
 phone ca 11 s are
scanners cover all of the above
mentioned scanner frequencies
as well as the 800 Mhz cellular
telephones (provided the man­
ufacturer hasn't locked out the
capability). Note that cellular
telephones are of a wider band­
width than most other scanner
signals, and the average scan­
ner may lose the peaks of some
words, especially a high­
pitched women's voice or a per­
son screaming. For an
antenna, start with the whip
antenna on the scanner: slide
it in all the way so that it is as
short as possible (800 Mhz is a
small wavelength. so shorter
antennas are called forl.
Experiment also with angling
the whip for better reception.
Or purchase an outdoor anten­
na that is tuned for 800 Mhz.
Or purchase a car cellular
antenna and mount it outside
your window (or on your rooD.
870.000 to 890.000
and don't want to buy any? If
(base stations (cells) for the
your neighbors are using the
standard cellular system.)
older models of cordless
890.000 to 896.000
(base stations for the extended
cellular channels. Not in
widespread use yet.)
Palle 20 2600 Mallazine Winter 1988·89
As mentioned before, the
unenforceable ECPA bans lis­
tening to cellular telephones.
Old Television Set: Some of
the frequency space for cellular
telephones used to be UHF 'IV
channels 79 through 83. That's
why newer 'IV sets have less
UHF channels. If you don't
have an 800 Mhz scanner yet.
make sure there's an antenna
attached (either the UHF loop
or the UHF lead-in from an
outdoor antenna). and try tun­
ing across those channels. A
continuous tuning knob will
work better than the click stop
kind. Cellular telephone calls
on your 'IV set could be consid­
ered unwanted Interference.
but the law mandates that you
tum your TV set off as soon as
you realize that you are receiv­
ing protected communications.
Standard AM Radio: Haven't
got any fancy radio equipment
phones, you might be able to
pick up the base channel at the
far end of the AM dial (past
1600).
In the air

WHAT MIGHT YOU HEAR ON A CAR < Kids are great, Bill.

PHONE? WE'RE NOT SAYING THAT > You got 'em a iob yet?

ANYONE ACTUAllY USTENS TO THIS < What?

STUFF AND THEN WRIrES Ir DOWN > You got 'em a iob yet?

FOR MAGAZINE ARTICLES, BUT I F

THEY DID, IT MIGHT LOOK LIKE > I feel bad for me. I feel bad

THIS •••• for both of us. My heart

hurts too. I love you.

> Ithink that•••the part of the < Who loves you?

problem is that they got -­ > (osculating noises) I would

they got a buyer for, for kiss it if I could kiss your

Kent. We'll ius' make it back heart.

in the commission for Kent. < (giggle)

Now you understand that? > It was beating like a little

< Who'll iust make it back? thumper before.

> Huh? < Really?

<Who? > (more osculating noises)

> Jerry, Larry, and you. < God....

> A nice !iffle orgy.

> What do you do with 0 < Umm, I know. God you

group like that? You know. I feel great down there

meon what, I mean what, tonight.

what do you with somebody > Yeah I had it in, I was

like the deal? holding it differently.

< I don't know whot you do < Oh. Felt wonderful.

anymore. I mean, the music > Did you notice that?

is changing so radically it's < Yeah. I told you it felt

hord to keep up. great, whatever it was you

> Yeah. were doing.

< It's hard to find out what to > Uh huh.

do it anyway. < I could tell it was diHerent,

> Yeah. but I don't know what it,

< You know? you're doing.

> Yeah. Yup. How's the kids? > Yeah. It was definitely dif­

< How're the kids? ferent•••• (pause) Want me to

> Yeah. tell you what I did?

Winter 1988-89 2600 Magazine Page 21

 do not at tem pt

< Sure.
> Okay, then you know
> I like squished it with my
what I'm talking about.
left hand. And I iust left a
< Of course I know, but you
space open for that leeeetle
know, you're looking at it
clitoris to stick out.
like through a microscope••••
< You were squishing it?
> No••..
Cause it felt like you were
< And you're going to say it's

pulling it apart?
entirely different but if you

> Well, at the same time I

stand back and say "Hey••••"

was, had the two fingers

> Alright, watch what hap·

pulling it apart but the bot·

pens with this one••••

tom of my hand, was like,

< Well, I think we could do

squashing it in.
well with it, but it really is

< Uh, well, that felt great.

basically the same concept.

(pause) Oh. God I was

> I don't think so, not at all.

horny.
< You don't think it's the

> You're horny now?

same concept?

< No, I was horny.

> No, nope.

> Oh.
< Noh, then you're losing it.

> No I think they're all ••

< Which one••

> No, the one we run last

> •• and when can you give

year was our art deco.

me an answer?

< Yeah?
< Right.

> This is totally different.

> And it was very nice. But

We're nof talking about the

you can't, I mean she was on

same one. The one -­ the phone with Brian this

< Totally different is the dif­

morning, and, and suddenly

ference between an eagle

it was, it was the money

and an automobile. they're

thing. And I got on the ••

totally different.
< What's the money thing?

> It's not.

> You know, and I got on the

< Sheesh. You're talking

phone with him and I said

about a yoke treatment that

Brian, just, you know, come

comes down like a V, one is

over here and look!

ort deco, one is floral ••••

< But you could take almost

Page 22 2600 Magazine Winter 1988-89

this at home

everything. routines they want, construc­

> I know. tie»n's slowing down right

< You know -- it's also both­ now.

ering you in the background. > I know.

> No. < And if they want -- you

< Oh yeah. know, uh.... Lexington

> Not with Brian. Avenue -­

< Brian, he knows Brian all > I know.

so well. < And Bergen Avenue.

> Yeah, but Brian and he did > I know.

not get along very well. < And Old Bergen Avenue.

< Yeah, but Bobby seems

has been to his head, you
>. know.

< Uh, ., they iust gotta

know, 'Be careful, you're understand, uh you know, I

gonna get screwed.' mean • goHa, what I goHa

> yeah•••• do is start going out there

< You know, you know, uh more to see him then.

yo know you hear it from, > Uh huh.

you know, either I get < And, you know, doing my

screwed or you're gonna routine and say I know how

get -­ to do very well with that.

> Oh, I know, I know, but > Right, exactly.

you know on the other hand < They would give me a

after you talk to him for a fucking break, we have

few minutes he's coming some closings, we'll pay you,

over at one o'clock to you know we're right

work••• ~ Howard? around that time, we're clos­

< No bullshit about it. ing, you iust gOHa wait a lit­

> Yeah, but, uh, you know I tle while.

mean they see, they see a lot > That's right, that's right.

of work going on down it's THIs IS fHE FIRST IN AN OCCASION­

going to change people's AL salES ON POSSI81E CONVERSA­

aHitudes. TIONS THAT ANYONE COULD
< You know he -- if he wants OVERHEAR. IF THIS HAD 8EEN A N
to ierk -- you know, you ACTUAL CONVERSAnON, LOOKING
know he could play all the AT fHlS ARnell WOULD 8E IWGAL.

Winter 1988-89 2600 Magazine Page 23


Some Ideas
Dear 2600:
After month's of agonizing
over 2600's financial plight. I've
figured out a way to return to
the monthly format and solve
another great problem that
plagues BBS's all over the
nation. How many times have
you logged onto your favorite
BBS and seen some message
like this: "It has come to my
attention that someone else is
using my name, 'The Grim
Reaper', on other BBS's. Well.
whoever you are. I'm the real
Grim Reaper. I was The Grim
Reaper months before you
came around. You better not
use my name any more. or I'm
gonna kick your $#&*@ ass!!!
You better think of a new name
dude!!!"
Well. the obvious solution to
this common dilemma is to
have a sort of "name registra­
tion". where individuals can
register their alias with an
authority -- kind of like your
given name when you're born.
And who else would be the
most likely authorization but
the hackers' and phreaks'
chOice -- 2600! Think about it!
You could charge each registra­
tion a nominal fee. like $3. For
that $3. you will give the per­
son a registration certificate.
saying that he is the only one
authorized to use a particular
PageU 2600 Magazine Winter 1988-89
Letters For
alias within a given limit. say.
an area code. The person could
get some little certificate to
hang on his wall,. and maybe
even a patch to sew on his
jacket.
So the next time the loser
user logs onto the BBS, he can
now proudly assert: "By the
power of 2600, I am the only
Grim Reapel" within the 212
area code. I· am the only one
certified and authOrized to use
that pseudonym. So be gone.
you pagan!"
So, whadaya say? 2600
could be put into the black,
and we would no longer have to
put up with dueling 14 year
aIds. We have a unique oppor­
tunity to help solve the hack­
ers' two most serious problems.
No thanks. There must be a
better way to raise funds than
to play big brother to dueling
14 year olds. Besides, how in
the world would the user be
able to prove that he/she was
the one with the certificate
hanging on their wall?
Computers still offer a degree
of anonymity. Let's all try to
enjoy that while we can.
Articles & Boards
Dear 2600:
After having received your
volume 4. number 10 issue, I
was truly amazed! It's great to
Winter Reading
see a publication that is
straightforward and informa­
tive. It wIttingly caters to the
novice, as well as those of us
who hopelessly suffer from
occasional periods of "hack
attacks". Good jobn
I would like to inquire about
submission of written articles,
relevant computer news, news­
paper stories, and the like. I
believe I have or can obtain
eno~gh data to "publish" at
least one article on a minJrnum
quarterly basis. Also submit­
table would be a collection of
"postings" from the area net­
works which would be of worth
to your magazine.
Next on my list Is the hope of
being allowed to operate a
Greater New Orleans branch of
2600 Magazine BBS. I know of
many people and users who
would be more than happy to
benefit by logging into a system
like such. A BBS of the like
would offer its users a wealth
of information that would oth­
erwise be inaccessIble, or
worse yet, unnoticed! As I soon
will have a phone installed with
a few extremely advantageous
services such as call forward­
ing and call transferring. I will
also be able to link users to
systems that would be out of
their reach but within mine! I
think that the combination of
what a 2600 Magazine BBS
Winter 1988-89
could offer. plus a bit of effort
on my part. would bring about
great results.
8W
You can contact us with your
BBS ideas by caRing 516-751­
2600. We're also always ask­
ing for unspltct1ed articles, so tf
you have something you think
we rn.ight publish, send it in.
Needlnjo
Dear 2800:
I understand that the
Telecaption Adaptor II available
from Sears can be extended
with a few parts to have an
RS232C serial output port for a
computer. I would like to find
out how to do such a modJfica­
Uon so that the 'IV subcaption
output can be displayed on a
Teleprompter with RS232
input. This would allow people
who are both hearing and sight
impaired to understand 'IV. My
grandmother cannot see the
tiny letters that the TeA 11 gen­
erates on the screen. I would
appreciate any information on
how to accomplish this modifi­
cation.
Handel
AT&T Nightmare
Dear 2600:
Our small liberal arts college
recently switched over from its
2600 Magazine Page2S

old crossbar system to the
AT&T System 85 early this
year. In the old days, you sub­
scribed to Wisconsin Bell (like
all Wisconsin residents). had
your name in the phone direc­
tory. were available through
directory assiStance. and could
use your long-diStance service
with the 1+ option. That has
changed since then. If technol­
ogy is supposed to make life·
easier, it doesn't and it also
makes it a hell of alot more
expensive.. .. To make a long
distance call. we now have to
dial the 800 port (I use Sprint)
and use a calling card to place
the call. For those of you who
use software for your modems.
try programming a 20+
sequence! Then we also are
charged a 50 cent surcharge
for placing the calli And if
you're like me. that really adds
up. We are unable to call 950's,
"toll free" Wisconsin Bell lines.
and we are unable to tum off
call waiting for an incoming
call. Good if you are trying to
run a BBS from your dorm
room. There are only '37 outgo­
ing lines, and 27 incoming. So
during normal business hours
(the school's bUSiness office is
also on the system). you will be
unable to place a call! Someone
from AT&T also forgot to pro­
gram all of the reachable pre­
fixes in our area! Even some of
Page 26 2600 Magazine Winter 1988·89
The Winter
our faculty cannot call home!
For a system that is supposed
to be "smart'" it sure isn't. If I
were to call myself using the
prefix that the school is acces­
sible through. the phone sys­
tem doesn't even know to just
use an internal switch. Instead
it goes ahead and wastes an
outgoing and incoming line"
while I talk to myself. So to
prove to the school that some­
thing needs to be done. we're
getting 37 people to call them­
selves during busy business
hours. and make the system
paralyzed ... for about 4 hours.
That should teach them what
they refuse to liSten to. Like all
systems. no one cares until it
happens to them....
Cray-Z Phreaker
SkunkWorb
The bug you're about to
exploit is probably the easiest
part of the system to frx. All
they have to do is block out
that exchange like they've
blocked out others. But the
point is you have to get the col­
lege and the phone company to
listen to you, the end user. You
must do whatever you see fit
This means being -loud and
specific as to what problems
you're faced with. Remember.
you have the same right to tele­
phone service as anyone else
in thiS country. Being at a col-
Letters Column
lege does not mean you're sign­
ing away this right. Demand
answers and if you don't get
them. make sure every body
knows it.
And a message to AT&T:
This is the second time in as
many issues that we've heard
major complaints about your
System 85. Last time it was
the House of Representatives.
Who will it be next?
Call Forwarding
Dear 2600:
I'm hoping you may be able
to answer some questions
regarding the phone company's
availability of call forwarding.
As it stands. in order to acti­
vate call forwarding. you must
have the service on your line
and you must activate it from
that line. It must be deactivat­
ed from the same phone that it
was activated on.
My question is thiS: is it pos­
sible to forward Phone "A" to
Phone "8" from Phone "e"?
Also. is it possible to have a
pay phone forwarded to your
location?
JH
There are remote call for­
warding devices available that
allow you to change the num·
ber you're forwarding to and to
cancel call forwarding from a
remote location. We talked
Winter 1988-89
about these in our last issue.
So far we haven't seen a phone
company offer these services.
Regardless of who offers it.
though. there is another poten­
tiill security risk here.
With regards to using for­
warding on a payphone. there
are two answers. The first is
no. That is, accordlng to the
phone company. After all. why
would anyone want to use for­
warding on a payphone? It's
simply not possible. The other
answer is yes. Of course, it's
possible. Hackers have done it
by using the phone company's
computer. And we don't doubt
that law enforcement has
made use of it on occasion.
What better way to trick a drug
dealer or kidnapper call1ng a
payphone?
Obseroations
Dear 2600:
Seeing how you have pub­
lished updates to the 800
exchanges that are owned by
IC·s. here are some 800
exchanges that belong to other
companies. as well as some of
the same companies (MCI,
SprInt. etc.). These all work
from my NPA. and I liVe in the
midwest. I know that one carri­
er (LYfEL) is a re-seller of long
distance lines to FG-8 carriers
in my area. Anyway, the list:
800 + NXX
2600 Magazine Page 27

373 - Teleconnect
383 Teleconnect
456 MCI
472 - AT&T
589 - LYIEL
636 - Conquest Long Distance
668 - AT&T
686 - Conquest Long Distance
728 Teleconnect
747 Teleconnect
798 - Teleconnect
829 - Sprint
869 - Sprint
873 - MCI
These are the exchanges that
I have found that were not list­
ed in any issue of 2600 under
any company. There may be
more. since I compiled this list
a few months ago. Also.
Teleconnect in this case is not
the same company that runs
Teleconnect Magazine. I am
told. I can usually tell by lis­
tening if the exchange is owned
by an lC, as there seems to be
more noise and static on the
connections and in the back­
ground than there is with
AT&T 800 numbers. Also, in
my area at least. the connec­
tion time for an AT&T 800
number is less than for an IC­
owned 800 number. Western
Union's service used to be such
poor quality in my area that
when I dialed 10220# (their
equal access override), I could
hear the noise being cut for
ANI and called number out-
Page 28 2600 Magazine Winter 1988-89
We Really Like
pulsing. This also was the
same for AHnet.
Speaking of AHnet, I am a
legal customer of theirs, with
dial-up service. When I got my
authorization notice in the
mail. I discovered that my code
had been put in on Allnet's
800. 950, and local FG-A
dialups. On the 950 and local
FG-A node, I could use my 6
digit code "as is'', but with the
800 "Travel-Mate" service, I
must enter my 6 digit code,
plus my three digit PIN. (By the
way, AHnet used to use some
type of formula to derive cus­
tomers' PIN numbers. This for­
mula used part of the
customer's exchange as the
first digit of the PIN. I am just
mentioning this for the sake of
information. as they no longer
use this method. according to
customer service.) I am less
than happy with AHnet's ser­
vice they are raising prices in
my area for both dialup and
equal access dialing. Also. they
cannot seem to get their
records straight. Somehow I
was signed up with Allnet as
my PIC even thought I did not
choose them. I talked to cus­
tomer service about it as soon
as I found out and they told me
the problem would be fixed.
Soon afterwards. I received a
notice in the mail telling me
that I had been disconnected
Getting Your Letters
from AUnet. However, to this
day. I am still connected with
AHnet and they cannot get the
bills straight. They send the bill
for 1+ to my address for dial­
up bills. I have called them sev­
eral times and still they cannot
fIx this.
Also. to top things off. we
still received the charge from
our local BOC to pay for the
disconnection from AlInet even
though we are still connected. I
have called customer service a
number of times and they don't
seem to want to help. I have
considered dropping Allnet
because of the several things
they have done. but I am still a
customer of t heirs. The only
good thing about AlInet is that
they have a 45 second buffer
zone that is used when a call is
connected. So if you can keep a
call's time less than 45 sec­
onds. it won't show up on your
bill. I imagine that sooner or
later they will get the equip­
ment to detect answer supervi­
sion. but it looks like it will be
later.
In the Spring 88 issue you
published a list of BOC routing
and system codes. You asked if
anyone knew how to use the
Mexico function of RQS. You
can use this with a Mexico
NPA, such as 905. Just use
905 as the NPA and use two
Mexican exchanges in the
Winter 1988-89
exchange information. and
RQS will tell you the rate. If
you want to try this out, a valid
exchange in Mexico is 621. So
if you use 905+621 and get the
rate information for an intra­
office call (to the 905+621
exchangel. you will get a local
call message.
Also. a note to Telenet ID
users. according to Telenet
Customer Service, the cost of
getting an ID is $24 a month.
$18 a connect hour, and the
bills are itemized (shows that
the ID user conneded with). So
if this information is true, then
no wonder Telenet ID's always
die when people use them ille­
gally. Also. Telenet has a new
type of access management
system called TAMS (I am not
sure what it stands for) which
keeps better track of network
usage.
Phantom Phreaker
An increasing number of re­
operated 800 numbers actually
have better sound quality than
AT&Ts. They also have more
sophisticated caller identifica­
tion features.
If you have a letter to
send to us, drop it in the
mail addressed to: 2600
Letters Department. PO Box
99, Middle Island, NY
11953.
2600 Magazine Page 29
 by E. Solomenko
(reprinted from PravdaI
I fi rst came across her when as an
inter-city telephone operator in
Novosibirsk she tried long and hard
but without success to put me
through to Ashkhabad.
Her efforts were in vain. "I'm
sorry," she said, "I'll try via Mara."
Getting through to Mara was no
problem. "Hello, Mara? Can you
help me get a line to Ashkhabad?"
The reply was anything but sister­
ly, "Dial it yourself!" Then they cut
her off.
I reflected sadly that the lack of
solidarity in Mara was a far more
common approach than that of my
Novosibirsk guardian angel of the
telephone exchange. I remembered
how on a previous occasion I had
also been trying unsuccessfully to get
through to the elusive Ashkhabad,
when the operator told me that there
was a fault on the line.
Just in case, I decided to try get­
ting through without her help, by
dialing direct from the telephone
box. Miracle of miracles -- the inter­
city code worked and I got through.
The operator had told me there was
a fault in order to get rid of me.
Ashkhabad was notoriously diffi­
cult to get a line to. Yet now her
senior colleague was trying again
and again to connect me ond I could
hear Fier saying to the girl next to
her (she hod forgotten to switch me
off) that she hardly had any voice
left from shouting down the line to
Ashkhabad.
At long last I heard the voice of
PageJO 2600 Magazine Winter 1988·89
my friend, the artist Durda
Bairamov, over the line. We both
had to bellow in order to be heard;
the line was terrible. The operatar's
hoarse voice broke in as she started
relaying my questions to Durda and
his answers back to me. I felt very
touched by her concern and just had
to find out who she was.
Her name is Valentina Efimovna
Vdovina and she works in what they
simply refer to as the "inter-city",
which is one of the country's largest
telephone exchanges, connecting the
Urals with Kamchatka and Kuril.
So what is Valentina Efimovna
like?
"She's a conscientious worker,"
said the supervisor, T. Vereshchak.
"She never goes home until all the
calls that have been booked have
got through. Sometimes she sits on
into the night long after her shift has
gone off duty. We have a lot of
good operators here, but we all take
our hats off to Valentina."
Then who should come into the
room but Valentina herself. About
40 years of age, small with a round
face and short hair and very kind,
homely eyes. She sits down, obvi­
ously tired. Before lunch today she
wos working on eight calls at once.
Her iob isn't exactly a piece of
cake. She only has one day off a
week and has lost count of the num­
ber of national holidays she's spent
sitting in front of the switchboard.
She works six hour shifts doing what
amounts to a juggling act with both
hands, connecting and disconnect­
ing plugs from the switchboard.
 Then there are the operators' fet­
ters, the earphones with mouthpiece
attached. Just try s~nding a Whole
shift wearing those things! You soon
get bells rin9.ing permanently in your
head from the constant noise, and
this leads to headaches. Your voice
suffers too from the constant shout­
ing to make yourself heard over bod
lines.
It is no occident that state legisla­
tion allows for early retirement in
this job. After ten years in the inter­
city, you con retire on full pension at
50. Onlx a few soldier on for
longer. LilyaGleikh, Vera Raeva,
team leader Elsa Vasilievna ...
Ludmila Ivanovna Gorbatova has
served her for almost a quarter of a
century and has risen from operator
to manager. Other girls come here
straight from school and don't lost
two minutes.
"I'd get out myself/ sighed
Valentino Vdovina, "but I love my
work. I think of it as helping people
to meet each other. It's as if I have a
hand in their fates, even if only for a
minute."
I said that no doubt she over­
heard many conversations between
callers, not on purpose, of course,
but how else could she check the
quality of line and make sure that
they could hear each ather, how else
could she let them know that their
time was almost up?
Whether she likes it or not, the
operator must be party to ofher peo­
ple's secrets, to their joys and sad­
nesses. There must be calls from
sons returning from the army, calls
Winter 1988-89
to announce the birth of a grandson,
to say that somebocly has been put
in prison or that someone else lias
had a heart attack.
Sometimes they overhear whole
conversations, late at ni.9ht or on
holidoxs when there are fewer calls
going through. During normal work­
ing hours they only have time to
quickly listen to check that every­
thing is OK. Twenty seconds for
eaell coli and on to the next one.
A local call comes in. "please ~t
me thr~h to Lesosibirsk as quickly
as possible, my dear! II
"What number do you wont?"
Valentina asks.
"I'm afraid I don't know," sobs
the voice.
"Please don't cry. Let's try to think
how we can find the number. Who
do you want to ring there?"
"My daughter's had on accident
there," says the woman's tearful
voice.
"Don't worry. I'll get through as
quickly as I can. I expect the surgical
word of the hospital there will be
able to help."
She got through to her colleagues
in Krasnoyarsk who gave her a line
to Lesosibirsk. From there she got
through to the hospital and then to
the doctor in charge of the surgical
ward.
"Hello, this is the Novosibirsk
inter-city exchange. Has there been
a young woman admitted following
an acciCient? There has? Hong on a
second, I'll connect you to her moth­
eL"
Later the mother rang Valentina,
2600 Magazine Page 31
this time crying with relief. exchanges are all considered to be
"thank you my dear. I can't tell "one of us" at Novosibirsk.
you how much you helped me. I Valentino started off by working
don't know how to thank you for all On the Krasnoyarsk district link and
you did." now is on the Khabarovsk line which
She doesn't have to thank her. includes the whole of eastern
For Valentino the main thing was Kazakhstan plus a good chunk of
that the woman found her daughter, Novosibirsk province.
knows that she is olive and will get She is on important link for min­
better. That is the best thanks she ers, people working on the gas
can get. piP.E!line project and the agricultural
In the course of her work she industry. When there is on occident
comes across all sorts of different on the pipeline for example, or
people. Sometimes during the busi­ problems with drilling. When a cou­
est time, when all hell is let loose ple of teams are needed urgently
with ten calls going through the elsewhere -- all this concerns her
switchboard at a time, you suddenly and she does her best to help.
get on irate coller bursting in soying: Let's toke, for example, the
"How much longer must I wait? I Novosibirsk Pipeline Construction
haven't ~t all day you know. If you Trust. She knows as much about
don't pull your finger out 1'm going their business as its dispatch clerk,
to complain. " Vladimir Ivanovich Golitsin. She
"Sometimes we even have diffi­ knows that the Trust is involved in
culties with other operators," pipe projects in Belgo and in Lower
explained Ludmila Gorbatova. "We Tambovka, in Yagodnoe and in
can never get through to the Baku Krasnoyorsk.
inter-city exchange, the operator on "Hel/o, Mr. Golitsin, I'm putting
duty never answers. She's either you through to Belgo."
asleep or has gone off somewhere. "Hey, Valosho, what about a
"When she does finally answer hello first? How are you nowadays?"
she shouts something in "Hello Vladimir Ivanovich. I can't
Azerbaidjani down the phone and really talk for long now, the su~rvi­
hangs up. After which you can never sor's here and I'll get told off for
get bock through again. We have chattering!"
sent a complaint to the USSR The supervisor, Taisiya
Ministry of Communications and the Aleksondrovna just smiles. "You
Baku inter-city exchange, but with­ seem to know the whole country,
out result." Valya!"
V dovina says that she doesn't "Not quite," laughs Valentino,
very often come across operators "only half!"
like the one in Baku. The other Her son Seriozha more or less
Siberian operators in for eastern grew up in the exchange. When he

Page 32 2600 Magazine Winter 1988-89

U.S.S.R.

was in the fourth doss he was told to 18 days of holiday are over and she
write a composition called My Future is back at work -- how could they
Career. He wrote: "I want to be a manage without her? She hurries to
switchboard girl." When his mother light her beacon for the Sea of
saw it, she lQughed and told him to Anxiety, the Sea of Joy, and the Sea
change it to "man". He looked at of Loneliness.
her from under his brows and said: Tomorrow I shall have to ring
"What do you mean, 'man', when Khabarovsk. I'll dial the inter-city
they're all girls~" and book my call. And how'good it
Over the past two years she has will be to hear that friendly voice
not been very well. The strain of the saying, "Did you book a call to
job is starting to tell. Not long ago Khabarovsk? Putting you through
she did a break, but nOW' her short, nOW'. "

INTERNAnOlAL DIRECT DIAL SERVICE

-TO IRAN TEMPORARILY SUSPENDED
At the ~ ~~ goveni;nem of~ tbe·~~Cornp.nYofInmbas. attion
to deny Intematiooal Din:d Dial ServJce from the world into I.rm. Unti !urtber 1IOIice. aB AT"T
caBs from the U.s. M.mIaodmdHawaii to Jrmmilst lleplaa!d throughmAT&T Operator. Effective
Ailgust4.l988. thefollowingJlfCl!additionaIminbte~willappIy. I",,,,~·, . ..;''"< ' " ". '

" • ,OPERAlOR-ASStmD RATES:

, ..,... lNmAL3M1NUTES .>,
'. . . (AU DAY$-ALL HOURS)

. .
PwsoeRaht.3Minutes
.
'" SlUJ3
.

NEW ADDmONAL MINUTE RATES' .

. IRAN
Discout . Economy

Winter 1988-89 2600 Magazine Page 33

 an intervieW' W'ith
fly John Dralce
Not much is known about the Chaos
Computer Club, except for the abun­
dance of scary "you should hire me
because of hackers like them" tales
peddled by computer security consul­
tants.
Further hype about the "mythical
hacker elite" has also been perpetuat­
ed by the worldwide media coverage
when a story is picked up by a major
news service.
This past fall two members of the
Chaos Computer Club were passing
through my metropolis. They decided
to hunt me down with the little infor­
mation they had about me. Since they
didn't have the street number, the
duo spent a night ringing the door­
bells up and down the street asking
for John Drake.... Their eventual suc­
cess resulted in this interview.
WIIEII WAS' rifE CIIAOS'
CONpvrEIl Club fOllNEd1
HMMM, I CAN TEll you TkE dATE
WIiEN TIiE fiRST DATENScliEUdER
WAS dEliVEREd. Tliis WAS iN
FEbRUARY 1982 ANd iT WASN'T
pliOTOcopiEd. TIiE club MUST
IiAVE bEEN AROUNd SiNCE '81.
TIiE REASON TIiERE WERE SOME
CONTACTS bETWEEN TIiE IiACkERS
WAS TIiAT TIiERE WAS AN ARTiclE
iN A NEWSpApER iN GERMANy ....
I TliiNk iT WAS AN Ad, iN fAcT
SOME of us TRyiNG TO fiNd
pEop'lE iNTERESTEd iN COMPUT­
ERS, iN A pApER CAllEd
TAGENSiGN -- AN AlTERNATivE
NEWSpApER. Tliis is liow TIiEY
<lOT TO<lfTIiER.
AfTER THis, I TliiNk TIiERE WAS
Page 34 2600 Magazine
AN ARTIClE AbOUT MACkERS -­
pEoplE WOO wORk WiTk COM­
PUTERS ANd TIiAT MENTiONEd TkE
DATENSckJiUdERS. IT WAS iN DER
SpEi~At likE NEWSWEEk IiERE,
OR TIME, ANd SO suddENly
MANy p,EoplE pkONEd ANd
WANTEC:I TO GET TkE
DATENsckEU<lER. TkEN fROM
TkERE TkE SECONd iSSUE of
DATENscliEUdER WAS I!RiNTEd A
lOT, TkEN TkE CkAOS COMPUTER
Club.
Wllo rlfEII srAllrEdJ}ff
CIIAOS' Co",pvrEIl Clvb1
~~~R~ft~t~~ ~fR!~OOJl~i-
ANd lie GAVE TkE ROOMS TO
EoplE wko CAME TO ViSIT kiM
C£fORE iT WAS A club, ANd TkE
ROOMS of TkE CkAOS
COMPUTER Club ARE Also NEXT
dOOR TO kis plACE iN
HAMbuRG·
WIIEllli dOES' PErEIl GIASEIl
CONE '111
IN 1982, OR EVEN bEfORE
TkAT ... VERY EARly. PETER
GLASER liVEd iN HAMbURG. HE
WORkEd WiTk COMpUTERS fOR A
TEXT PROCESSiNG COMp'ANy. HE
kAd MANy CONTACTS Wllk
OTkER p'EoplE. SWEN YAckToff
liVEd wirk ltiM. SWEN WAS TIiE
fiRST TO kAYE CONTACTS wiTk
WAU Hol . HE WAS ONE of
TkE fiRST, befORE TkERE
WAS A DATENSCkE , OR
ANy'TliiNG of Tkis wlio
kA(I CONT ACTS wiTk AU
HollANd.
HE l.ivEd TOGfTkER wiTk PETER
SO TkERE WERE OTkER CONTACTS
TkERE ANd PETER would COME
iN CONTI~CT wiTk pEoplE wko
WERE USING COMpUTERS fOR
MORE TkAN oNly TYP.EWRiTiN!i.
So PETER bECAME A "IiAckER . I
the chaos computer club

<lmfT k~ow It liE IS REA.ll Y A. WITIiOUT STRUCTURES. ANyONE

~A.ckER .. ..iT'S A. siLLy WORd. CAN COME wiTItOUT ItAviNG TO
W~E~ ~ GOT A. ModEM fOR A. bE A. MEMbER.
biRT~dA.y P.RESE~T fROM SOME­
ONE fROM tltE CltA.OS How MANY pEoplE R~cElrE
COMPUTER Club, fROM TltM rifE DAJ'EffsclfElJdERl
TiME you o~ly SEE Itis bA.Ck.
YES, W~~ you WA.NTEd TO WE A.RE pRiNTiNG TWO Tkou­
COMMU~iCA.TE willt ltiM you SA.Nd, I TltiNik bUT oNly A.bOUT
~Ad TO buy A ModEM YOURSElf. 800 TO 100v A.RE A.CTUA.llY
BUT, dtM'S OVER NOW.c/ ~ o~ly MA.ill:d.
GOES ONliNE VERy sdaOM.

Ch4Ibt Computer Club, Sch......ellCkmf.85. 0·2000 HamtM-g 20. Telefon: (M(J. 490 3151. 8Tx ·CHAOS+

MailboxlVstem CLINCH 040 651 64 75, Vla D.t~)(·P 4440009031.., GEONei:GEOt:Chaof.TEAM

Ho tv ;$ rifE Clvb SEr vp IN

I!ElA r/oN ro
~;~:J~ ;r~I~li~l1 tov
D ATENsclfEvdER? ~"':1!iA~~E19t~~~~: c1:Jl
bREAkINti. iNro dNE sysrEM
DA TE~SC~EUdER is TItE pA.pER OR ANO.,..lfER....
of TItE club.
W~N you GiVE TItEM (TkE
Ho tv is rife clvb pRESS) SOMETltjNG TO EA.T, TItEY
OIlCiANizEd? A.U COME RUNNING.

T~AT'S VERy ItA.Rd TO SA.Y EXAMplES?

bECA.USE A.S A.~ officiA.llY REG­
iSTEREd club iJ's o~l y bl=E~ A. WltE~ you ItEA.R WE ltA.tlE JUST
yEAR NOW. BEfORE THEN IT WAS GONE iNTO A. dA.TA.bA.Nk, E\lERy­
lUST TkE C~A.OS COMPUTER ONE fROM TItE GERMA.N PRESS
ClUb. BUT T~E~ you ~EEd will COME A.Nd WRiTE A.bOUT iT.
SOMEO~E fOR TItE bA.Nk IN TItE bEGiNNiNG Tltis WA.S VERy
!,CCOU.NT ANd you NEEd A. REG­ fiNE A.Nd SOME Good A.CliONS
ISTRA TlON. CA.ME A.bOUT bECAUSE 0 TkE
IT's A GAlA.CTicA.l CO~NECTioN BETA.X ItAck...NOW TkERE is TkE

Winter 1988-89 2600 Magazi.ne Page 35


NA~A "'Ack W"'IC'" IS VERy
fAMOUS.
BUT OfTEN TliERE ARE JOURNAL­
iSTS wlio TkiNk "WliAT CAN WE
do iN OUR NEWSPAPER?" ANd
TliEN TliEy' SAY, Ali YES, SOME-
TliiNG WiTIi COMpUTERS LET'S
(!liONE TliE CliAOS COMPUTER
UUb. Is TliERE ANVONE HERE
Willi TliE NUMbER1" TkEN TkEY
pliONE ANd SAY, "PLEASE sliow
US SOME liAckiN4;t, lET'S SEE how
you do iT." AN<fyou CAN'T do
IT bECAUSE iT is fORbiddEN iN
GERMANY. IT's NOT TkE REASON
wliy TkE club ExisTS: fOR JOUR­
NAlisTS TO LET PEoplE kNOW
TliERE ARE liACkERS.
WliEN A bYTE SOMEwkERE GOES
WRONG TliEY AlWAY~ p,liONE TIiE
CliAOS COMPUTER Club,
bECAUSE TliEy TliiNk WE CAN fix
iT OR WE kNOW WliAT liAS liAP­
(?ENEd OR wlio did iT.
SOMEONE ONCE Tgld ME TliA T
bECAUSE of TkE CliAOS
COMPUTER Club liE liAd sold A
lOT MORE of liis SECURiTY sofT­
WARE ANd liE TliANkEd US.
Is rifE ",AIN AI", 01 rifE
C;1l0pp co",purEIl l;rEIlAcy
911 IS rllEIlE A IAcrlON
INsidE rll,! C;1l0Up 'Oil
IIACiERS
THERE ARE MANy diffERENT f.EO­
ptE wlio TliiNk of MANy dif ER­
EI'4T AiMS of TliE club, SOME of
rliEM sociAlly' ACCEp'TAblE
WAyS of WORkiNG WiTIi COM­
pUTERS. SoME of tliEM ARE
HAckERS bUT NOT AU of TliEM.
WE ARE NOT liAckERS.
Is ;r rllEN A {rRA/c;IIr COM­
purER club
No, iT'S NOT A NORMAL COMPUT­
ER club. IT'S MORE of A CliAOS
COMMUNicATioNS Club TliAN
CliAOS COMPUTER Club. I dON'T
Page 36 260() Magazine Winter 1988-89
the chaos
TJiINk you NEEd TIlE COMpUTER.
IT's MORE fOR pEOpLE wJio
TliiNk MORE TItAN JiAck PER­
liAp'S. TkERE ARE Also ~AckE~S
iN TkE club,- SURE, TkAT 50 A bIT
of TliE PROD1EM bECAUSE liAck­
ERS liAVE diffERENT iNTERESTS
TliAN p'EoplE likE ,us wko AR..E
MORE INTERESTEd IN COMMUNI­
CATiON ANd ART. WkElIER
TkEY'RE JUST fREAks TkAT kNOW
A lOT ADOUT TkE TECkNicAL
sidE....
TIERE ARE OTIiER p,EoplE iNTO
REAL livE liACkiNG, likt: skowiNG
p,RESS pASSES TO GET INTO
TkiNGS, TkAt'S REAl kACkiNG.
)VilA r rYrE ollll.,s EX;Sr
IN GEflNANY ro dErEIl
IfACkiNt;
AT TkE MOMENT wliEN you
CkANGE SOMETkiN<i iN SOMEONE
EhE'S COMP~TER, IT'S ALREAdy'
AN OffENSE. so WkEN you LOGiN
ANd YOU'RE NOT suppOSEd TO
lOGiN, YQ4 CliANGE SOMETliiNG
bECAUSE IT S REPORTEd SOME­
WliERE TkAT you liAVE lOGGEd
iN. So you liAlIE A1RE!)dy
CliANGEd SOMETliiNG if you fol­
Low THE lAW STRicTly. ITkiN"
TliAT TkEy' ARE STill WORkiNG
ON rlinE lAWS.
CALL OUR COMPUTER
BUllETIN BOARDS!
CENTRAL OFFICE (~14~2344260
YOYODYNE ·(40~}:S64~518
BEEHIVE .{70?j823cf3591
HACKER·SOE~. . . . . (718) ·358~9209
All avallab16~4/f()u"Bday.
No ,.g{stf'atlonn~sSBry.
IF VOO~REJNTE.RESTEDIN OPER­
AtlNGA2600BBS!tiONTAcT us
AT(516l151~2600,
computer club
Hils ~lfrO"E bEE" cAU'l"r
,."d tI,,~d
C"iI ll'lE 7
0" A "ACt,,,'l
ntE oNly TltiNG TIt~ T I CAN
TltiNk of is STEVE iN pRisON, bUT
ItE ItASN'T bEEN CItARGEd.
C,." you 'lirE ",E SO"'E
01 ",Edi,.
E~,.",pIE.1
d,srollrlo"l
TItERE W~S Tltis biT wiTlt ~ b~Nk
iN H~MbUR!I, ON A vidEOTEX
SYSTEM iN GERMANY. IT ItAS
M~Ny M~Ny bUGS ~Nd MANy
MiST~kES iN iT ~Nd wIlEN you
lt~vE ~N OVERflow of dAT~,
~Ny'TltiN<.I could lt~ppEN.
So iN TItIS WAY ThEy 10UNd OUT
TItE P~5SWORcI of this b~Nk iN
H~MbURG ~Nd TItEY USEd rliis,
~Nd TIlEN TIlE CIi~os COMPUTER
Club R~N A SECTiON of iNfoR­
M~TioN ~~GES ON TItE vidEOTEX
SYSTEM. -"TltEy ~lso Ii~VE ~
MoviE iN TIiERE wliicli you C~N
look ~T bUT you It~VE TO GiVE
~ dON~IioN fOR lookiNG ~T TItE
MoviE fiVE dolll\RS, witicli is
TItE M~xiMUM SUM fOR lookiNG
~T ~ vidEOTEX P'~GE.
WElt TIlEy M~aE TItE b~Nk
look ~T Tfli5..P~GE OVER ~N<t
OVER ~G~IN. 1ltEy' WROTE A lIT­
TlE .PRO~R~M 50 iT W~S ~lw~y's
C~UiNG iT b~ck ~G~iN ANd 1i~i1
iT RUN OVER TItE WEEkENd so Nt)
ONE fROM TIlE b~Nk W~S ThERE
TO SlOP iT. IN TItE ENd iT W~s
I~O,OOO M~Rks WORTIt of
dON~TioNS fROM TItE b~Nk TO
TkE Ck~os COMPUTER Club.
TkE Club could" lt~vE cl~iMEd
THE MONEy' fROM TItE bANk
bEC~USE TItERE ~RE NO l~ws
SAyiNG. THAT THis W~SN'T ok.
Tkty didN'T, bUT TkEY SkOWEd
TIiE N~TioN~l dAM SECURiTy
OffiCE WH~T is possiblE. TIfE
b~Nk WAS VERy TItANkhJl fOR
Winter 1988-89
ThE hiNT.
TIlE koST OPER~TOR of TIlE
SYSTEM s~id, "IT's ONly bEC~USE
oJ TIiE Ck~os CO~UTER Club
TIt~T TIlE BET~X vjd"EOTEX sys­
TEM is A flop." TItEY WERE
TElliNG.. us ~T TItE dEMONSTRA­
TiON 01 BEf~X TIi~T iT W~S
bEC~USE OlliE CItAOS
COMPUTER.Club TIi~T pEoplE
WON T USE IT.
Also, wkENEVER THERE is ~
SHOW of TItE BET~X vidEOTEX
!{Yn~M, pEQplE c~ll up TIiE
aub S MOVIE ON TItE dEMON­
STRATioN ~CCOUNTS.
Ho W dOES r"E,,,"O"E
SYSlE", WORt ,f; RfGARd ro
MOtlf'lslls Ir dIG'''''A' OR II
CIU"k,/f!; ",EC"" "'CA'
sysrE",r
You STillli~"E rliE clUNk,
clUNk, clUNk synEM iN MOST
TOWNS. THEY Ii~VE jyST ST~RrEd
TO CIt~NGE TO THE itiGiTAl sys­
TEM.
If you W~NT ~ ModEM you It~VE
ro buy ir OR RENT iT fROM TkE
p"on offict;:. OR .Y.OU USE ~
HAYES ModEM wHiclt is illEG~l.
TIlE ModEMS fROM TItE pOST
offiCE AREN'T VERy POWERful.
TIlERE iSN'T ~NY G.ood soh­
W~Rfi TO WORI( WITIt TIiEM ~Nd
TIto' RE VERY. EXP.ENShIE.
IN GERM~NY iT is fORbiddEN TO
do ANYTliiN~ YOURsElf wiTlt ritE
TElEplioNE liNE. TIlERE is ~ jOkE
TIt~T you EVEN NEEd PERMissiON
wltEN you USE ~ pEN TO di~l
TIlE pJiONE.
If you NEEd ~ lONGER c~blE
you 1t~\IE TO GO TO TIlE pOST
OffiCE ~Nd p~ Y 6~ M~Rks ~Nd
fill OUT ~ REQUEST fORM fOR ~
lONGER c~blE TO YOUR TElE­
pkoNE. .
2600 Magazine Page 37
 w-est germany's
~O pHONE pHIlEA~'Nfi IS
Not Allor subJEcr IN
GERMANY?
THERE ~RE SOMETiMES pEopLE
WHO TRy TO M~kE bLuE bOXES
OR THiNGS of THESE kiNd bUT I
dON'r kNow if ThEY wORk,
THERE W ~S ONf GUY WE kNEW
WHO H~d ~ THIN,G likE This, bUT
HE disAPPEAREd INTO pRisON
OR SOMEWhERE. WE kAVE TO
TRy...MAybE iT will WORk WhEN
ThE NEW SYSTEMS ARE iNSTAllEd.
TElEphoNE CAlls ARE VERY
EXP.ENSivE iN GERMANY, ESPE­
ciAlly lON~ diSTANCE CAlb ANd
SO iT wouLa bf A useful THiNG.
Wf ARE ChARGEd fOR AU ThE
LOCAL CAlls iN UNiTS of Ei!jHT
MiNUTES iN ThE dAY ANd 11' MiN­
UTES AT NiGhT.
WIIA r "rfPENEd 10 SrEffEN
WEIlRNE WilEN liE WENr ro
FRANCE
STEffEN WAS iNViTEd TO A SECU­
RiTy CON!iRESS TO REpORT
AbOUT WHAT hAPPENEd WiTh
NASA ANd TO ExpLAiN whAT is
possiblE iN ThESE NETWORks. HE
WAS ARREUEd Ri~hT AWAY
WHEN hE A.RRivEd In ThE AIR­
pORr il'tl FRANCE ANd QUES­
Tiol'tlEd fOR 24 hOURS.
ThEY '<EPT hiM ThERE WAiTiNG
wliilE THEY kAd AbsoluTEl Y NO
E\lidENCE WhATSOEVER ThAT liE
WAS iN ANy WAy iNvolvEd iN ThE
NASA STORy.
WIIA,. ACIUAli Y "~.PENEd
wi,.11 NASA AS op OSEd
ro. WIIA r rilE NEWJ APERS
SAId?
TIiEY'RE 1'tI0T MEMbERS of Thf
ChAOS COMPUTER Club. ThfY
WERE ONE yEAR WORkiNG fOR A
COMPANY Al'tld suddeNLy Tkey
Page 38 2600 Magazine Winter 1988-89
rOUNd OUT ThAT TI-Ey WERf IN
TkE NASA NETWORk. AfrER A
wkilE of WORkiNG iNSidE ThERE,
ThEY ONE dAy bEGAN TO UNdfR­
STANd TkAT iT WAS VERy dAN­
~EROUS.
ThfRE ARf STORiES AbOUT Tkf
CIA TkEy dON'T Ask QUES­
TiONS, bUT ShOOT fiRST. , dON'T
belieVE ThESE STORiES Mysdf,
bUT TkfN I TkiNk ThE AMERiCANS
MUST bE silly....
TkEN ONE dAY TkEY phONEd
ANd CAME TO ThE CHAOS
COMPUTER Club ANd SAid TO
ThE pEoplf ThfRE, :WE hAVE
SOME COMpUTER pRINTOUT ANd
WE dON'T WANT TO bE killfd by
iT. WkAT shAll WE d01­
STEffEI'tI ANd W AU SAid OK,
kEEP QUiET ANd WE will USE
OUR COI'tlTACn. TkEN ThE
MAChil'tlE STARTEd. ThEY TRiEd
TO GiVE iNfORMATioN TO ThE
CIA viA TkE GERMAN SECRET
SERVicE. TkEy SAW ThAT ONE
WEEk lATER TItE ACCOUNT WAS
STil~ WORkiNG. TkEy GAVE
NOTICE TO TkE COMPANY ThAT
WAS MANUfACTURiNG ThE TERMi­
NAL SOfTWARE. TkEN ThERE WAS
A. NEW VERSiON diSTRibuTI:d
ThAT STill CARRiEd ThE SAME
MiSTAkE.
WIIAr did rilE COM"'UNicA­
dON sofrWARE Allow you
ro do?
ITAUowfd you TO look AT Tke
USfR liST. USUAlly iT TElls you
ThAT you hAVE NO PERMiSSiON
TO Look AT iT OR do ANYTkiNG
ThERE. IT GAVE TkE WARNINCiiN
ThE PROGRAM bUT iT WOu[(JN'T
CUT you off. You could GO
fARTkE~ despiTE iT SAyiNG you
couldi'll T.
So TkEy WENT iN ANd G,AVE
ThEMSElVES pRiviLEGES IN ThE
SyS~EM, ANd TkEY pUT iN ThesE
TROJAN hORSfS -- PROGRAMS
"computer hackers"

THAT WipEd OUT All TRACES of 258 pages softcover

ThEMSEl liES iN ThE SYSTEM SO NO
ONE kNEW. IT Abo COpiEd iTSElf
iNTO OThER SYUEMS ON ThE
NETWORk ANd bROUGHT bACk
iNfoRMATioN AbOUT PASSWORds
TO ThE kids. ThEy hAliE bEEN iN
In diffERENT SYSTEMS.
DiE HJtC~E' BibE' I " II,
""Ar IS Ir
You fiNd SOME REPRiNTS of
Hackers Conference.
SOME AMERiCAN STuff iN iT
ISBN 3-922708-98-6
Published by Der Grune,
Zweig 98, West Germany.
Cost 15 dollars US approximate.
- Original Material written for Bibel.
- Photocopy art/humour related to
computers and hackers.
-Newsclippmgsandarl~~sfrom
various sources.
Includes reprinted article about

HAPt cOMplETE REPRiNTS of

- Reprints from Datenscheuder.
old DATENschEUdER, ANd SOME
Early YIPL 1-22 reprints and TAP
ARTiclES you will ONly fiNd iN
23-27.
ThE book'. You CAN fiNd This
- About 40% of the book is in English.
OllER ThE COUNTER iN ANy
- A good reason to learn German.
boqkuORE.
Chaos Computer Club:
I THINk iT HAS AN ISO NUMbER.
0-2000, Hamburg 20 or
DiE HACkER BibEl II is dUE

SOON. IT's bEEN p-RiNTEd. WE'RE

Schwenclcestrasse 85
WAiTiNG fOR STEffEN TO SENd US
West Germany
COpiES. DiE HACkER BibEl III is
01149404903757, 0114940483752.
Nola! bEiNG WORkEd ON.

Winter 1988-89 2600 Magazine Page 39

 UNIX HACKING

(continued from page /7)

wd" command as shown below:

to another directory.
$passwd
$ mv letter letters
Changing password for john
$
Old password:
This example renames the file letter
New password:
to letters, thereby deleting letter. If you
Retype new password:
want to move files then you would
$ enter:
This will only work when the pass­ $ mv lusr/john/pers/capital
word has aged enough. lusr/john/michelle/capital
ps $
It's sometimes necessary to see This moves the file capital to the
what command processes you are directory named michelle.
running. This command lets you see diff
thaI. The format is: ps [-a all process­ Format: diff [file name] [ file name].
es except group leaders] [-e all pro­ This shows the difference between
cesses] [-I the whole list]. two files. Output of this will have
$ps something like 4,5c4,5 then it will dis­
PID TTY TIME COMMAND play both sets of files on the screen.
200 tty0914:20 ps The 4,5c4,5 means that you must
The system reports the PID - the change "c" lines 4 to 5 in one file to
process identification number which is line 4 to 5 in another.
a number from 1-30,000 assigned to Options for using this command
UNIX processes. It also reports the are: ·b (it ignores blank spaces), -h
TTY, TIME, and the COMMAND being (compares it quickly), -s (reports files
executed at the time. To stop a pro­ that are the same), -S[file] (this is used
cess enter: when you want to compare a directory
$ kill [PID] (in this case it's 200) starting at a specific file).
200 terminated There is also a command to com­
$ pare 3 files which is:
grep diff3 [options] [tile 1 ] [file2] [file3]
This command is important when cp
searching for a word or words in large Format: cp [file name] [file name].
files. The format is' grep [argument] This makes a copy of a file.
[file name]. It searches for a file that $ cp letter letters
contains the argument specified. $
$ grep phone cathy The file letters is a duplicate copy
phone michelle (718)5551234 of letter. In this case the original is not
phone cindy (718)5553456 erased like in the mv command.
What this did was to find the argu­ (End of Part One. Part Two will
ment "phone" in the file cathy. II the appear in the Spring 1989 issue and
argument consists of two or more will incfude more UNIX commands,
words, then It must be enclosed in sin­ sending and receiving messages, and
gle quotes. super user commands.)
mv
Format mv [file names(s)) [dir
name]. This renames a file or moves it

Page .:If) 2600 Magazine Winter 1988·89

 2600 Marketplace
WANTED: Text files/ Countlegger/
Ph rack news clippings on hackers,
phreaks, etc. from newspapers and
magazines. Willing to payor trade.
Send a list to KH, N. 11107 Roundup,
Mead, W A 99021.
W ANTED: Any hacking programs for
the Atari ST. Will trade. Also in need
of good blue box plans. Would love to
hear from other persons interested in
P /H from Lexington, KY. Aristotle,
606-258-2219.
COMPUTERIZED LEARNING
USER'S GROUP, ELECTRONICS is
for those inter­
ested in learning
electronics and
related tech­
nologies as well
as those interest­
ed in develop- ,
ing, evaluating,
sharing, and
selling hard­
ware and soft­
ware to do so. Write CLUGE, 207 East
School Street, Kent, Ohio 44240-3837
or call 2]6-678-4611.
WANTED: Red box and/or blue box,
tone chips for making boxes,
Macintosh software for trade via mail
or moderl;l and vending machine lock­
pick gun/tools. Douglas, PO Box 8022,
Richmond, IN 47374.
FOR SALE: 3 Comtech model 550
Satellite Video Receivers. Best offer,
first come, first served! Send reply to
either dtroup@carroll1.uucp or send
real mail to: DTROUP/Room 205st,
221 N. East Ave., Waukesha, WI,
33186. Skunk Works!
FOR SA LE: Various UNIX man­
ua Is /books. For more information,
write to Seth K., PO Box 245070,
Brooklyn, NY 11224.
Winter 1988-89
I WANT TO START a newsletter devoted
to petty crimes, tentatively titled "For
Informational Purposes Only", Please send
me info, clippings, on how to rip-off vend­
ing machines, free postage, free photo­
copies, sneaking into movie theaters, etc.
Tun CridJand, PO Box 85874, SE9ttle, WA
98145.
WILL TRADE: My Texas Instrument
Silent 700 Series Portable Intelligent
Data Terminal (like new) w/full docu­
mentation for any hacker software for
IBM compatible computers. Ted K.,
PO Box 533, Auburn, NY 13021-0533.
COMPLETE
RANGE of
Commodore 64
hack/phreak
software. All
................ tested and
debugged.
Many advanced
applications.
Call1HC-][ BBS
at 604-595-0085
and leave feedt-eck to the sysop for more
information.
TAP BACK ISSUES, complete set Vol.
1-90 of QUALITY copies from origi­
nals. Includes schematics and indexes.
$100 postpaid via UPS or First Class
Mail. Cash/MO sent same day, checks
to Pete G., P.O. Box 463, Mt. Laurel, NJ
08054. We are the original; all others
are copies!
2600 MEETINGS. First Friday of the
month at the Citicorp Center-from 6
to 8 pm in the Market (also known as
the lobby with the tables where all of
the weirdos hang out). Located at 153
East 53rd Street, New York City. Come
by, drop off articles, ask questions.
Call 516-751-2600 for still more info.
Deadline for Spring Marketplace:
3/1/89.
2600 Magazine Page 41

by Dr. Williams
One of the most obvious ways
of obtaining free telephone service
is through "hardwiring" -- that is,
directly connecting a phone to
somebody else's line without their
knowledge. This can be accom­
plished in a few different manners.
One technique is just to hook up a
phone to the exterior of a house or
business. Another way, canning, is
a little less blunt. Any dime store
phone can be hooked up, and
walaa! Free telephone service is
yours just for the begging.
There are basically two types of
exterior phone boxes that are used
for homes and small businesses.
The older ones are a pukey green
color, are square, and have four
terminals inside: two for the
grounds, and two for the charged
wires. These are kept closed by a
long bolt. The newer ones are
rectangular and have a phone jack
inside of them. They are kept
closed by a lid. There is only one
tool you'll need, and that is a touch
tone phone. The ones where all of
the components are contained in
the headset are the best for this.
Take the cord, cut it in the middle,
and strip the wires on both halves.
There should be four wires: a
green, red, black, and yellow. The
green and red ones carry the cur­
rent, and the black and yellow are
the grounds. There could be some
variations in the colors of the
wires, depending on the phone,
but there should always be two'
Page 42 2600 Magazine Winter 1988-89
HARDWIRING
grounds and two charged wires.
After stripping the wires, put an
alligator clip on the green and red
wire on both halves. Putting one
on the grounds is a good idea too.
Now you have what it takes to
connect up to any phone box. On
the older ones where there are just
four terminal posts, you take the
headset and connect up to the ter­
minals via the alligator clips on the
headset. You won't need to use
the other half of the cord with the
phone jack since there is no place
to hook it up. You may also have
to bring some vise grips to
unscrew the bolt which holds the
box closed. Sometimes, the colors
of the terminals aren't marked, so
it will take some trial and error to
find the two live ones. On the
newer boxes that have a tele­
phone jack inside of them, you use
the other half of your cord contain­
ing the jack to plug inside of it.
Then you connect the alligator
clips together on the headset. This
should be no problem to open
since they are held down with a
plastiC lid. Easy, isn't it! One note,
though. There may be other varia­
tions out there. From my experi­
ence, these are the most common
types of boxes.
There are some drawbacks;
relationships are always two­
sided. The good pOints are that it's
easy (it beats hacking out codes to
the local extender at the pay
phone) and, since most residential
areas still use AT&T as their pri-
YOURWAYIN
mary carrier, you can call any­
where in the world. Some other
long distance carriers have limited
calling areas. The drawbacks are,
first, you have to do this at night -­
like, 3 or 4 am. If you do this, you
always run the risk of getting
caught. Some neighbor might think
you're a prowler. You should
therefore dress in dark clothes and
not carry any identification with
you. There is also a limited
amount of things you can do. After
all, you can't call up your relatives
or too many of your friends at that
time of day.
There is a wealth of locations
where one can try to hook up. One
spot is housing construction -­
going up and coming down.
Sometimes, when houses or
apartments are being built, the
phones are connected before con­
struction is complete. I've also
seen cases where people move
out and the phones are not discon­
nected. Once the people lived in a
mobile home and they moved out,
leaving a vacant lot with a utility
pole. Well, 10 and behold, the
phone was still connected. The
phone company didn't disconnect
it until about seven months later,
and that was after practically
everyone in the neighborhood had
crank-called people in Japan and
Australia. You can also try rural
neighborhoods late at night,
although using your own probably
isn't a good idea.
Small business clusters or
Winter 1988-89
industrial centers are also good
spots. These usually have the
green boxes clumped together in
lots Of four. Late at night, no one is
around, so it's only a matter of
hooking up. I'm talking about those
places where a company leases
the shop or office space to various
companies. Trying to hook up
where a 7-11 is located probably
wouldn't be too smart.
Canning
A subject I'm going to touch
upon is canning. The rea,son I say
I just want to "touch" upon it is
because this topic really deserves
a whole article by itself, but since
you can use the same tools of the
trade, I'm going to mention it here.
Cans are those ugly green con­
tainers that stick out of the ground.
Most of the smaller and isolated
cans can be easily opened with
vise grips. The bigger ones some­
times have locks on them, but
nothing a bolt cutter couldn't han­
dle. Most cans that I've come
across come in two flavors: ones
where there are just masses of
individual telephone wires
clumped together, and the others
that break apart the clumps of
wires to help the distribution of the
telephone wires. The ones that
have just the bundles of wires
clumped together I've found to be
of little use. I imagine that a guy
would have to match up the two
wires for each single phone to get
a current that will work. But then
again, I'm not an expert.
2600 Magazine Page 43
HARDWIRING PHONE SERVICE

Sometimes these do break up a The real benefit of hooking up

few individual houses in the neigh­ comes when you own a portable
borhood. There might be a metal computer with a modem. If you
plate attached to the top of the can find a target computer that you'd
with four or five terminals sticking like to get to know better, and
out. Use trial and error again to you're not stupid enough to try to
find a live current. It is usually pret­ get to it from your home phone,
ty easy. The other cans, the bigger then this might be a good way to
ones which are sometimes locked, go. Portables are going down in
can be a goldmine. They usually price; I've seen some in pawn
distribute pairs of wires in a hori­ shops for about $125.
zontal fashion, with a row of metal There are a couple of other
stubs sticking out. Inside it might observations that I'd like to make.
look a bit confusing. Around the I've attended two different high
perimeter, there are wads of wires schools and I found their long dis­
tangled together and going every tance dialing procedures in the
which way Inside the perimeter same place On the principal's
are rows and rows of square desk, there was a bread board that
metallic stubs. These stubs are slid out on the left hand side. The
thin, about three eighths of an inch instructions for making long dis­
wide, and they stick out about an tance calls were typed on a piece
inch The telephone wires will con­ of paper taped to this location.
nect to both sides of the horizontal Perhaps this is a common occur­
rows of these metallic stubs. All rence. I've also lived in a few dif­
you need to do is connect up to ferent dorms, and I've noticed
two horizontal stubs. Not all of the similarities in their setup too. In
wires in the can may be live, so each room there was a plated tele­
you need more than one try. phone jack The plate was only
Sometimes these bigger cans held down by two flathead screws.
have some goodies in them, such I unscrewed the plate and behind
as lineman's headsets and papers were most of the telephone wires
containing technical data. From for the whole floor. I could have
what I understand, the purpose of hooked up to any room on the
these cans is to help troubleshoot floor undetected.
problems by breaking up units (or Finally, if you find that any of
clusters of wires) into smaller the above works out pretty good
units I want to emphasize that I for you, don't be too greedy,
am not an expert on these cans. stupid, or start taking life for grant­
These are just my observations ed. As they say on Wall Street:
and I'm sure things work differently "Bulls make money, bears make
in different parts of the nation. money, pigs get slaughtered."

26()O Magazine Winfl'f 1988-89

 BOOK REVIEW
Tune In On Telephone calls
by Tom Kneitel
Published by CRB Research,
Box 56, Commack NY 11725
160 pages, $12.95
Reviewed by Lou Scannon
Telephone calls have been car­
ried on radio waves for years -­
from ships at sea, from cars, and,
since the advent of microwave and
satellite technology, even the aver­
age long distance call travels
through the ether for a portion of
its route. And unlike the private
medium of telephone wires, where
a physical intrusion is required to
listen in on the conversations,
radio waves are everywhere
around us and need only the right
kind of receiver to pull them in.
Although most people know
about the existence of car phones,
there are a good number of other
telephone services on the air:
including cordless phones, local
marine telephones, ships on the
high seas and more. The conver­
sations can range from the ordi­
nary chitchat and gossip of your
neighbors, to a lonely seaman
talking to his wife or children, or to
your local drug dealer planning his
next purchase of controlled sub­
stances.
Alas, thanks to a recent act of
Congress called the "Electronic
Communications Privacy Act"
(ECPA for short), listening to some
kinds of telephone calls over the
radio is illegal. Which kinds? Well,
it's hard to say. If it's from a car,
Winter 1988-89
then it's definitely illegal to eaves­
drop, if it's from a cordless tele­
phone, then it's maybe illegal, and
if it's from a boat or airplane, then
it's perfectly OK. The law does not
specify how the radio enthusiast is
supposed to be able to distinguish
between protected traffic and
unprotected traffic.
Fortunately. the Justice
Department has announced that
they have no plans to enforce this
portion of the ECPA which is just
as well, as the thought of the Feds
breaking into your house to see
where you have been tuning your
radio tends to put a damper on
radiotelephone eavesdropping.
From the editor of Popular
Communications magazine comes
a book that promises to explain
how you can become a radio
voyeur and listen in. And indeed it
does. except by the time you come
to the end of the book you're won­
dering what you paid for. More
than a third of the book (60 pages)
is composed of channel allocation
charts of questionable value.
There's no index or bibliography,
the latter which would have been
useful as the reader is referred to
other books whenever the author
declines to delve too deep into the
technicalities. All in all, a steep
price for a few frequency charts
and a lot of folksy diatribe against
the ECPA. Kneitel may have got­
ten too used to writing monthly
magazine editorials and seems
unable to talk about cellular
2600 Magazine Page 45
 BOOK REVIEW: TUNE IN ON TELEPHONE CALLS
phones without sniping a1 the
industry lobbyists and membf)rs of
Congress who sponsoreri the
ECPA. Although the ECPA is with­
out a doubt bad legislation that
fails to understand the technnlogy
it purports to regulate, Kn'9itel
spends far too much space ill an
already sparse tome whining
about it,
For the complete novice, th0re's
a short chapter on what kind of
equipment you'll need (a sc,mner
that covers the 870-896 Mhz cellu­
lar band and a general coverage
shortwave receiver), and a few tips
on antennas. Kneitel has (1 few
good words for the Radio Shack
PRO-2004 scanner, which after a
quick modification (also described
in the book) becomes an efficient
machine for following cellular calls.
The book covers each portion of
the radio spectrum that contains
something to do with telephone
calls. Car phones, cordless
phones, wilderness and remote
area phones, radio common carri­
ers, beepers, local marine, region­
al marine, high seas marine, and
oil rigs.
Satellite and microwave links
are briefly touched upon, but the
equipment needed for intercepting
microwave links isn't described. A
little miscellany that might not be
easily found elsewhere is also
included, such as telephone com­
pany maintenance frequencies,
experimental air and railroad
phone services, and the MARS
Pug" ./6 260() Magazine Winter /988-89
military network used for patching
phone calls for uniformed person­
nel on ships or at U.S. bases over­
seas.
Although the book is informa­
tive, it is a skinny volume at a fat
price. With a little trimming, it
would have made a good article in
Popular Communications, and
would only have cost $2.50 at the
newsstand. For more complete
information on channel allocations,
Radio Shack sells the "Police Call
Radio Guide", which contains
complete scanner frequency list­
ings for a particular area, This will
tell you just about everything,
though it's in a hard to digest for­
mat and you'll have to dig for what
you want. For station listings in the
shortwave band, which will include
a worldwide rundown of the mar­
itime telephone frequencies and
military MARS frequencies (but
again they'll be buried among a lot
of other frequency listings), see
the "Confidential Frequency List",
from Gilfer Shortwave (800-GIL­
FER-1 or 201-391-7887, Box 239,
52 Park Avenue, Park Ridge, NJ
07656.
@&3
Fint Friday of the month in
the lobby of the Citicorp
Center, 53rd Street, between
3rd and leHington, NYC from
5pm to Spm. Call (516) 751
2600 for more info.
 IMPORTANT NOTICE

sing costs are forcing us to raise our sub­

sc ion prices slightly. If you renew your

subscription before March 1st, you can beat

the increase. The old rates are to the left

and the new ones are to ght. You can

renew now even if your ion doesn't

expire for a long time. We'll just add the

t on. You have the choice of tearing out

s page and sending it back to us (your

address label on the back tells us who you
are) or sending one of your own pieces of
explaining just what it is you want.
Please note that even though it obviously
isn't the fourth quarter of 1988, this is the
Winter 1988 ion and not the Spring 1989
one. We're sorry for any confusion.

INDIVIDUAL SUBSCRIPTION

:.:.t 1 year/$15/$18 0 2 years/$28/$33 0 3 years/$41/$48

CORPORATE SUBSCRIPTION

o 1 year/$40/$45 ::J 2 years/$75/$85 0 3 years/$11 0/$125

OVERSEAS SUBSCRIPTION

:.:.t 1 year, individual/$25/$30 ::J 1 year, corporate/$55/$65

LIFETIME SUBSCRIPTION

[) $260 (you'll never have to deal with this again)

BACK ISSUES (never out of date and the same old price!)

.J 1984/$25 ::J 1985/$25 0 1986/$25 0 1987/$25

Q 1988/$25
TOTAL AMOUNT ENCLOSED:
 CONTENTS

THE INTERNET WORM STORY 4

MCI RIPPING OFF CUSTOMERS 10

HACKER'S GUIDE TO UNIX 12

OVERHEARING PHONE CALLS 19

LETTERS 24

SOVIET OPERATORS 30

CHAOS COMPUTER CLUB 34

2600 MARKETPLACE 41

HARDWIRING FREE CALLS 42

REVIEW: TUNE IN ON PHONE CALLS 45

2600 Magazine SECOND CLASS POST AGE

PO DOH 152
Perm,1 Pend,"!! at

Middle Island, NY 11953 u.s.n. East Setauket. N Y

t 1733

ISSN 0749·3851

Forwarding and nddress Correction Requested